justAntlrPlus

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Extension Purpose: This extension claims to be "a simple tool for operating antlr" (ANTLR parser generator). ANTLR is a legitimate language parsing tool used by developers to create parsers and compilers.

Filesystem and Process Access Assessment: The evidence shows 101 code-smell findings and 532 IoC findings, but critically, zero malware-signature findings, zero network findings, and zero secret findings. The code-smell findings represent standard Node.js patterns for file operations and process management that ANTLR tooling legitimately requires. There are no postinstall payload execution findings, no suspicious shell command execution, and no workspace file reads combined with external network calls. The extension's stated purpose justifies filesystem access for reading grammar files and generating parsers.

Credential Access Assessment: The evidence explicitly shows 0 secret findings. There are no findings indicating access to .env files, .git/config, SSH keys, cloud credentials, or VS Code's secret storage. The credential-related code-smell findings (part of the 101 total) match benign patterns like environment variable references for configuration, not actual credential theft.

IoC Findings Analysis: All 532 IoC findings are documentation URLs from npm packages and GitHub repositories. Specific examples include XIOC-URL-https://github.com/isaacs/node-graceful-fs, XIOC-URL-https://nodejs.org/api/fs.html, XIOC-URL-https://github.com/jprichardson/node-fs-extra, and XIOC-URL-https://github.com/libuv/libuv/pull/1088. These URLs are extracted from README files, package.json comments, and bundled library documentation—not actual network destinations. This matches the known false-positive pattern where XIOC extracts URLs from documentation and comments rather than active network calls.

Strongest Counterargument: The most significant concern is the extension's low user count (178 users) combined with a recent version number (0.0.5), which indicates a new or less-established publisher. However, this does not constitute evidence of malicious behavior. Niche development tools often have small user bases, and version numbers reflect development maturity, not security posture. The absence of any actual malicious indicators—zero malware signatures, zero network findings, zero secret findings—outweighs this concern.

Conclusion: This extension exhibits no evidence of malicious behavior. All findings are consistent with known false-positive patterns: IoC from documentation URLs and code-smell from standard Node.js patterns. The extension's stated purpose (ANTLR tooling) justifies its filesystem and process access patterns.

Key Reasons

• Zero malware-signature, network, and secret findings
• All 532 IoC findings are documentation URLs from npm/GitHub, not active network calls
• 101 code-smell findings represent standard Node.js patterns for legitimate tooling
• Extension purpose (ANTLR parser generator) justifies filesystem and process access

False Positive Considerations

• XIOC URL extraction from documentation and comments
• Code-smell rules matching standard Node.js patterns
• Bundled dependency documentation URLs
• npm package README references in source files

Reviewed 2026-05-08; recommended action: suppress false positive; model confidence 88%.