AWS Core
Based on the RiskyPlugins AI security review of the observed evidence.
No individual score drivers were recorded for this analysis.
Analysis record
- Analysed
- 4 days ago
- Version
- v3.106.252
- Artifact
- SHA256 740…642
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
10 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | PM Zip with js | 6 | plugin-core/lib/webview.jarplugin-core/lib/resources.jarplugin-core/lib/sdk-codegen.jar +3 more | - |
| LOW | postinstall persistence mechanism | 3 | plugin-core/lib/utils-2.26.25.jarplugin-core/lib/httpclient-4.5.13.jarplugin-core/lib/aws-toolkit-jetbrains.jetbrains-community.jar | - |
| LOW | postinstall system command | 22 | plugin-core/lib/webview.jarplugin-core/lib/slf4j-api-2.0.16.jarplugin-core/lib/ecs-2.26.25.jar +19 more | - |
| LOW | postinstall crypto operations | 11 | plugin-core/lib/ecr-2.26.25.jarplugin-core/lib/auth-2.26.25.jarplugin-core/lib/httpclient-4.5.13.jar +8 more | - |
| LOW | postinstall file manipulation | 10 | plugin-core/lib/httpclient-4.5.13.jarplugin-core/lib/sdk-codegen.jarplugin-core/lib/ecr-2.26.25.jar +7 more | - |
| LOW | JavaDropper | 3 | plugin-core/lib/s3-2.26.25.jarplugin-core/lib/iam-2.26.25.jarplugin-core/lib/sdk-codegen.jar | - |
| LOW | postinstall registry modification | 10 | plugin-core/lib/httpclient-4.5.13.jarplugin-core/lib/aws-xml-protocol-2.26.25.jarplugin-core/lib/httpcore-4.4.16.jar +7 more | - |
| LOW | postinstall network communication | 27 | plugin-core/lib/retries-spi-2.26.25.jarplugin-core/lib/sts-2.26.25.jarplugin-core/lib/ecr-2.26.25.jar +24 more | - |
| LOW | postinstall obfuscation | 26 | plugin-core/lib/sts-2.26.25.jarplugin-core/lib/snakeyaml-2.2.jarplugin-core/lib/ecr-2.26.25.jar +23 more | - |
| LOW | postinstall file download | 16 | plugin-core/lib/aws-toolkit-jetbrains.jetbrains-community.jarplugin-core/lib/utils-2.26.25.jarplugin-core/lib/httpcore-4.4.16.jar +13 more | - |
Publisher Evidence
HighAWS
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
11 evidence rows available.
Finding Categories
YARA Rules Matched
10 rules(134 hits)AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality strong.
This is the AWS Core extension published by Amazon Web Services on JetBrains Marketplace with over 13 million users. The extension's stated purpose is providing AWS SDK integration for development, which legitimately requires bundling AWS SDK libraries.
Filesystem/Process Access Justification: All 65 findings in the evidence are metadata hashes for standard AWS SDK JAR files located in plugin-core/lib/, including sdk-core-2.26.25.jar, auth-2.26.25.jar, aws-query-protocol-2.26.25.jar, http-client-spi-2.26.25.jar, and supporting libraries like slf4j-api-2.0.16.jar and commons-logging-1.2.jar. These are expected dependencies for any AWS tooling extension. The findings_summary shows zero threat indicators across all categories: no malware signatures, no IoC matches, no obfuscation, no secret access, and no code-smell findings.
Credential Access Findings: The findings_summary explicitly shows "secret":"0" - there are no credential-access findings. The auth-2.26.25.jar file is the AWS authentication SDK library, which handles AWS credentials as part of its legitimate function. This is not credential theft; it's the extension's core purpose to help developers work with AWS services.
Strongest Counterargument: Someone might argue that bundling authentication libraries could be a vector for credential exfiltration. However, this counterargument fails because: (1) the extension is from Amazon Web Services themselves, the same organization that operates the AWS services; (2) there are zero network-related findings in the evidence; (3) there are zero obfuscation or code-smell findings that would indicate hidden malicious behavior; (4) the 13 million user count and verified publisher status on JetBrains Marketplace provide strong provenance signals. The metadata findings on bundled JARs are expected behavior for any extension that includes third-party libraries.
This extension represents the baseline for legitimate IDE tooling: verified publisher, massive user base, standard SDK dependencies, and no security findings beyond expected metadata on bundled libraries.
Key Reasons
- Verified publisher (Amazon Web Services) with 13M+ users
- All findings are info-level metadata on standard AWS SDK libraries
- Zero threat indicators across all security categories
- Bundled dependencies are expected for AWS tooling extension
False Positive Considerations
- Bundled AWS SDK JAR dependencies trigger metadata findings
- All 65 findings are info-level with no threat indicators
- Zero malware, IoC, obfuscation, or secret findings in findings_summary
Reviewed 2026-05-23; recommended action: suppress false positive; model confidence 95%.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace