Napi Generator

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Napi Generator is a JetBrains plugin, version 1.0.3, with roughly 1,420 installs, that helps developers build Node-API bindings. JetBrains plugins run inside the IDE process with the user's own file access, so the question worth asking is whether anything here reaches outside that job.

Nothing in the findings does. There are no malware signature matches, no secret matches, no obfuscation hits, and no dependency or tool-poisoning entries. What remains is 947 medium-severity indicators, all filed against the same generic path, extracted_from_files, with titles such as XIOC-DOMAIN-kx.sz, XIOC-DOMAIN-db.ad, XIOC-DOMAIN-u.tt and XIOC-DOMAIN-ƒ.sg.

Those are not domains. XIOC-DOMAIN-ƒ.sg carries a Latin ƒ (U+0192), the endpoint list includes 0쁄.ad with a Hangul syllable, and the rest are two- to four-character stems bolted onto country suffixes: kx.sz, r.cc, x.tk, q.bt. This is what a regex produces when it sweeps minified JavaScript for anything shaped like label-dot-label. The endpoint list runs alphabetically from 0b.aw through 4x.lu, which is the output of an extraction pass over a bundle, not a set of hosts a plugin contacts.

On filesystem and process access: generating bindings means reading a project's sources and running build tooling, and a JVM plugin operates with the IDE's own file access. The listing declares no host permissions, and the only file path attached to any indicator is the extraction bucket rather than a named config, key or credential file. Nothing here reads .env, .ssh, .git/config or a cloud credential store. A generator needs to see the project it is generating for.

On credentials: the secret category is empty. The eleven low-severity code-smell matches are code-quality heuristics; the same rules fire on any non-trivial JavaScript or Kotlin that touches process.env, an eval-shaped call or a crypto import. None of them name a file, and none carry a severity above low.

The strongest argument against this read is the raw number: 947 medium indicators is a lot, and one working command-and-control host buried in there would change everything. The individual entries defeat that argument. ƒ.sg and 0쁄.ad cannot resolve as written. kx.sz, u.tt and c.bs have the shape a minifier leaves behind when chains like b.call or h.next get split by an extraction pass. Someone hiding a real callback address would use a domain that resolves, not a single Hangul syllable in front of .ad. The volume tracks the size of the bundled code, not intent.

The finding set is scanner noise over build output, and the plugin's access matches what a binding generator is for.

Key Reasons

• Every IoC indicator is a non-registrable fragment: XIOC-DOMAIN-ƒ.sg contains U+0192 and the endpoint 0쁄.ad contains a Hangul syllable, all extracted from minified code under the generic path extracted_from_files.
• Zero matches in the malware-signature, secret, obfuscation, dependency and tool-poisoning categories.
• The plugin declares no permissions and no host permissions, and no endpoint in the list resolves to a real host.
• Filesystem and process use is consistent with a Node-API binding generator reading project sources and invoking build tooling inside the IDE process.
• The eleven low-severity code-smell hits are code-quality heuristics with no attached file path.

False Positive Considerations

• XIOC domain regex sweeping minified JavaScript produces two-character label plus ccTLD fragments such as kx.sz, r.cc, u.tt and x.tk.
• Non-registrable strings in the IoC list: XIOC-DOMAIN-ƒ.sg contains U+0192 and 0쁄.ad contains a Hangul syllable.
• Low-severity code-smell rules that fire on ordinary Node.js and JVM patterns, with no malware, secret or obfuscation category matching.
• All indicators share the generic file path extracted_from_files rather than a named credential, config or executable file.

Reviewed 2026-09-30; recommended action: suppress false positive; model confidence 82%.