reStructuredText

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-05-23. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive. Evidence context: threat category none; evidence quality moderate.

The reStructuredText extension by lextudio is a well-established language support tool with 757,240 users and version 190.4.12, indicating long-term maintenance on the VS Code marketplace. The extension's stated purpose—providing RST/ReST linter, preview, and IntelliSense—fully justifies its filesystem and network access patterns.

The 13 dependency findings are all standard VS Code extension libraries: lodash.throttle, inversify, vscode-nls, node-fetch, mime, meaw, @jedithepro/system-info, and tslib. These are legitimate packages found in /tmp/extract-70ef12f015dcfa04052b25313b6a3c80292d9b09e5dbf0d4a508cc02e7bc8f7e-4154706797/extension/package.json and are commonly used for internationalization, dependency injection, HTTP requests, and type support.

The four medium-severity network findings (NET-SOCKET_IO-extension/dist/node/extension.js-229, NET-SOCKET_IO-extension/dist/node/extension.js-228, NET-JQUERY_AJAX-extension/dist/node/extension.js-1, NET-SOCKET_IO-extension/dist/node/extension.js-230) all originate from the bundled dist/ folder. Socket.IO and jQuery AJAX are standard communication mechanisms for VS Code extensions that need to talk to language servers or webview components. No specific suspicious domains were detected, and the threat_indicators show zero IoC hits, zero malware signatures, and zero obfuscation findings.

There are no credential-access findings in the secret category, no code-smell detections, and no file exfiltration patterns. The extension does not read .env files, SSH keys, or cloud credentials, and there is no evidence of workspace file reads combined with external network calls that would indicate IP exfiltration.

The strongest counterargument is the presence of network calls in the extension code, which could theoretically be used for data exfiltration. However, this does not change the conclusion because: (1) the network calls are in bundled dist/ output, not activation-time payload code; (2) Socket.IO is a legitimate language server communication protocol; (3) there are zero IoC hits on any domains; and (4) the extension has 757k+ users over many years without reported security incidents. The finding nature—standard language server infrastructure—does not indicate malicious intent.

Key Reasons

• Zero malware signatures, IoC hits, or obfuscation findings
• 757k+ users and long version history indicate legitimacy
• Network calls are standard Socket.IO in bundled dist/ code
• No credential access or secret findings detected
• All dependencies are standard VS Code extension libraries

False Positive Considerations

• Bundled dist/ code triggering network detections
• Socket.IO used legitimately for language server communication
• Standard VS Code extension dependencies flagged as findings
• No actual malicious indicators despite 17 total findings