Saladict - Pop-up Dictionary

AI Security Review

Evidence context: threat category typosquatting; evidence quality moderate.

This extension claims to be "Saladict - Pop-up Dictionary and Page Translator" by developer "rumosky" with 0 users and unknown version. The evidence presents conflicting signals that require runtime analysis to resolve.

The network findings are benign: all 35 network detections originate from assets/pdf/build/pdf.worker.js and assets/pdf/build/pdf.js, which are legitimate PDF.js library files. These fetch and xmlhttprequest calls are expected behavior for PDF rendering functionality, not suspicious network activity. This aligns with the extension's described feature of "PDF selection searching."

However, the malware signature count of 441 is significant and warrants investigation. According to the threat model, malware signatures co-located with obfuscation in the same file indicate malicious behavior. The evidence shows only 1 obfuscation finding, but the specific file locations of the 441 malware signatures are not provided in the findings bucket. This prevents determining whether signatures originate from legitimate bundled libraries (common false positive pattern) or actual malicious code.

The extension metadata raises red flags: version is "unknown" and user count is 0. The legitimate Saladict extension has thousands of users and a different developer attribution. This could indicate typosquatting, but could also be a new or regional variant. The developer name "rumosky" does not match the known Saladict publisher.

The 1959 IoC findings are high-volume noise that requires domain-level inspection. Without seeing specific domains, these could be garbage IoCs from the extractor or legitimate dictionary API endpoints. The guidelines state IoC COUNT alone is meaningless; only specific suspicious domains matter.

Counterargument: A skeptic would argue this is the legitimate Saladict extension with false positives from bundled PDF.js and dictionary libraries, since the network findings are clearly from legitimate code. However, the unknown version field, zero users, and 441 malware signatures create genuine uncertainty that cannot be resolved without inspecting the actual malware signature locations and comparing against the legitimate extension's codebase.

Runtime analysis is required to determine if this is a malicious clone impersonating Saladict or a legitimate extension with inflated false positive counts.

Key Reasons

• 441 malware signatures require location verification to distinguish bundled code from actual malware
• Version field is unknown, preventing comparison with legitimate Saladict versions
• Zero users and developer name mismatch with known Saladict publisher suggest possible typosquatting
• Network findings are benign PDF.js library calls, not suspicious activity

False Positive Considerations

• Bundled PDF.js library files triggering network findings
• High IoC count from dictionary API endpoints or blocklist data
• Malware signatures potentially from bundled dependencies in dist/ files

Reviewed 2026-04-27; recommended action: runtime analysis; model confidence 65%.