RocketRide

AI Security Review

Evidence context: threat category none; evidence quality moderate.

RocketRide is a Visual Studio Code extension published by RocketRide with 237 installs at version 1.1.0. The evidence shows no malware signatures, no IoC hits, no obfuscation findings, no secret-access detections, and no code-smell triggers — all of which are reassuring indicators.

The extension's dependency list includes packages that explain its network activity. The @octokit/rest dependency at package.json indicates GitHub API integration, which justifies the fetch call in extension/out/engine/cloud/engine-cloud.js:71. The dockerode dependency suggests Docker container management functionality. The adm-zip and tar dependencies indicate archive handling capabilities. The chart.js dependency implies data visualization in the extension's UI. The proper-lockfile dependency suggests file-locking for concurrent access safety. The workspace dependencies (rocketride@workspace:* and shared@workspace:*) indicate a monorepo build structure, which is a normal development pattern.

The two network findings are a fetch call in engine-cloud.js:71 and a WebSocket connection in extension/rocketride.js:27. The fetch call is consistent with the @octokit/rest GitHub API dependency. The WebSocket connection could be for real-time communication with a cloud engine or remote service. Neither finding alone is suspicious, but the combination of cloud engine networking with Docker management and archive handling means the extension has broad system access that should be verified against its stated purpose.

There are no credential-access findings — no reads of .env, .ssh, .git/config, or cloud credential files were detected. There is no postinstall script execution, no tool-poisoning indicators, and no evidence of source code exfiltration.

The strongest counterargument to further scrutiny is that all findings are fully explained by legitimate dependencies: GitHub API access, Docker management, archive handling, and chart visualization. The complete absence of malware signatures, IoC hits, secret access, and obfuscation strongly suggests this is a legitimate developer tool. However, the low install count (237) combined with broad capabilities (cloud engine, Docker, file archives) means manual confirmation of the extension's stated purpose is warranted before clearing it entirely.

Key Reasons

• No malware signatures, IoC hits, or secret-access findings detected
• Network calls are consistent with declared dependencies (@octokit/rest, dockerode)
• Low download count (237) with broad system access warrants verification
• No postinstall payload, obfuscation, or tool-poisoning indicators
• WebSocket connection in rocketride.js requires manual review to confirm purpose

False Positive Considerations

• Network findings are expected given GitHub API and cloud engine dependencies
• Archive dependencies (tar, adm-zip) are common in developer tooling
• Workspace monorepo dependencies are a normal build pattern

Reviewed 2026-05-25; recommended action: reanalyze; model confidence 65%.