lua-plus

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The LuaHelper extension, developed by xuyanfeng, provides features such as Intellisense, Linting, Debugging, Code formatting, and more. The extension's stated purpose is to assist with Lua development. Upon reviewing the findings, it is evident that the extension makes network calls of types 'websocket', 'socket_io', and 'xmlhttprequest' in various test files, such as WebSocketServer.test.js, WebSocket.test.js, and test-request-methods.js. These network calls are likely related to the extension's testing and debugging functionality. The NET-WEBSOCKET findings in WebSocketServer.test.js:217 and WebSocket.test.js:294 indicate the use of websockets for testing purposes. Additionally, the NET-FETCH finding in feeds.js:178 suggests the use of the fetch API for retrieving data. However, there are no indications of malicious activity, such as credential theft or data exfiltration. The strongest counterargument to this verdict is that the extension has a large number of findings, including 2715 code-smell findings. However, upon closer inspection, these findings are primarily related to the extension's use of bundled dependencies and do not indicate malicious intent. The extension's access to the filesystem and processes is justified by its stated purpose as a development tool. The findings related to network calls and code smells do not target real secrets or indicate malicious behavior. In conclusion, the LuaHelper extension is likely a false positive, as its findings can be explained by its legitimate functionality and bundled dependencies.

Key Reasons

• network calls for testing and debugging
• bundled dependencies
• code smells

False Positive Considerations

• bundled dependencies
• code smells

Reviewed 2026-05-24; recommended action: no action; model confidence 80%.