LeetCode with Auth Sync

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The filesystem and process access patterns in this extension are justified by its stated purpose of solving LeetCode problems with browser authentication synchronization. The 35 network findings all originate from bundled npm dependencies, not custom extension code. Specifically, extension/node_modules/axios/lib/adapters/http.js-70, extension/node_modules/htmlparser2/lib/FeedHandler.js-27, and extension/node_modules/jsdom/lib/jsdom/browser/resource-loader.js-210 contain standard HTTP client and DOM parsing library code. These are expected network calls for an extension that fetches LeetCode problems and synchronizes browser authentication state.

Credential-access findings are absent from the analysis. The findings summary shows zero secret findings ("secret":"0"), meaning no code was detected reading .env files, .git/config, SSH keys, or cloud credentials. The zero malware signatures ("malware-signature":"0") and zero malware findings ("malware":"0") indicate no malicious patterns matched against known threat databases. The obfuscation count is also zero, ruling out intentional code concealment.

The strongest counterargument to this verdict is the combination of zero user count with the "auth sync" functionality. An extension at version 0.18.11 with no installations suggests either a very recent upload or deliberate avoidance of visibility. Browser authentication synchronization inherently requires handling sensitive credentials, and unofficial extensions claiming this capability should be scrutinized for credential interception. However, the technical findings do not support malicious intent—there are no secret-access patterns, no credential-theft signatures, and no suspicious custom network destinations. The 21,198 IoC findings represent false positives from bundled dependencies, consistent with the known CVEQ noise pattern where npm packages trigger multiplicative IoC matches.

The network findings in extension/node_modules/axios/dist/axios.js-4862, extension/node_modules/axios/dist/esm/axios.js-4699, and similar paths are standard HTTP client library implementations, not custom exfiltration code. The extension's functionality legitimately requires HTTP requests to fetch LeetCode problems and synchronize authentication state with browser sessions. Without evidence of credential theft, malware signatures, or suspicious custom network destinations, the findings reflect expected behavior for a browser-sync extension using standard npm dependencies.

Key Reasons

• All 35 network findings located in bundled npm dependencies, not custom code
• Zero malware signatures and zero secret/credential findings
• Zero user count for version 0.18.11 suggests potential supply chain risk
• Unofficial extension with auth-sync functionality requires operational monitoring

False Positive Considerations

• Bundled npm dependencies (axios, htmlparser2, jsdom) triggering network findings
• IoC extractor matching standard library patterns as suspicious domains/addresses
• High finding count from dependency multiplicity, not malicious code
• Zero malware signatures despite 21,198 total findings indicates noise

Reviewed 2026-06-05; recommended action: monitor; model confidence 72%.