Web Guardian: Phishing & Malware Protection

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Web Guardian: Phishing & Malware Protection is a Chrome extension at version 0.7.0 with around 576 users, published under the contact address [email protected]. The bundle is a Vue and Vite build: chunk names like chunks/_plugin-vue_export-helper-BiXgYSDl.js, chunks/_virtual_wxt-html-plugins-P2Xu9kJm.js and chunks/welcome-A8-XPiYB.js are ordinary output from a wxt/Vite pipeline.

Across 392 findings, nothing matched a malware signature. No obfuscation was detected, no embedded secrets, no dependency risk, no tool-poisoning hits. The 274 indicator entries are the expected shape of a protection add-on that ships a domain feed: a tool that blocks phishing pages has to carry the list of domains it blocks.

The endpoint list backs that up. It holds aarp.org, abc.com, accounts.youtube.com, amazon.com, brainly.com, cbs.com and cartoonnetwork.com, the sort of mix that shows up on scam and phishing feeds, alongside a Google OAuth client ID (812707853907-9o271c7fbg18t067pdt8eodp5noed3tt.apps.googleusercontent.com) for account sign-in. A large share of the same list is extractor noise: animation.play, button.bg, animationitem.prototype.play, animationmanager.play and canvasrendererbase.prototype.show are JavaScript property accesses, not hostnames.

The nine network findings are socket.io and fetch matches inside the extension's own code. background.js:64 carries both NET-SOCKET_IO and NET-FETCH on one line, with more in chunks/_plugin-vue_export-helper-BiXgYSDl.js and content-scripts/usage-helper.js:5. A persistent socket in a background worker is how a live-protection service receives real-time verdicts. The 108 code-smell hits sit in the same bundled chunks and carry no behavioral weight. One manifest-analysis finding is recorded without explanation, and the record lists no permissions and no host permissions, which for a page blocker is more plausibly a parsing gap than a clean manifest.

A skeptic would push on three points. The publisher is an email address rather than a company name, an extension that blocks pages before they load should need host access, and something in the manifest was flagged. Those are fair observations, and none of them describe behavior. The two findings that would move this to malware, a signature match or an obfuscated payload, are both at zero, and the entire network surface is socket.io traffic plus a Google login endpoint.

What would change the read: a socket destination outside the vendor's own infrastructure, a cookie or credential read paired with an outbound upload, or a manifest entry granting more than the store listing states. None of those are in this scan.

Key Reasons

• Zero malware signatures, obfuscation, secrets, dependency or tool-poisoning findings across 392 total hits.
• 274 indicator entries match the expected shape of a bundled phishing and malware domain feed, including aarp.org, amazon.com and accounts.youtube.com.
• Much of the endpoint list is extractor debris: animation.play, button.bg, animationitem.prototype.play and canvasrendererbase.prototype.show are JavaScript property accesses, not hostnames.
• The nine network findings are socket.io and fetch calls in the extension's own code (background.js:64, chunks/_plugin-vue_export-helper-BiXgYSDl.js, content-scripts/usage-helper.js:5), consistent with a live-protection backend.
• 108 code-smell hits sit in the same bundled Vue/Vite chunks and describe code style rather than behavior.

False Positive Considerations

• IoC extractor reads JavaScript property chains such as animation.play and button.bg as domains
• Bundled Vue/Vite chunks inflate code-smell and network counts multiplicatively
• A phishing-protection blocklist legitimately embeds hundreds of domain indicators
• Generic socket.io and fetch matches on ordinary web-application code

Reviewed 2026-10-16; recommended action: suppress false positive; model confidence 75%.