az-func-as-a-graph

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-05-22. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive. Evidence context: threat category none; evidence quality weak.

This Azure Functions visualization extension triggers 33 high-severity YARA findings, but every single finding has "unknown_file" as the file path, indicating these matches come from bundled or minified JavaScript where static analysis cannot resolve specific source locations. The findings_summary categorizes all 33 findings as "code-smell" rather than actual malware, with zero findings in the ioc, malware-signature, or obfuscation threat indicator categories.

The YARA rules that triggered are all known false-positive patterns: YARA--postinstall_network_communication, YARA--postinstall_file_manipulation, YARA--postinstall_system_command, YARA--postinstall_file_download, YARA--postinstall_registry_modification, YARA--postinstall_persistence_mechanism, YARA--credential_env_files, and YARA--NoUseWeakRandom. These rules match basic Node.js patterns that legitimate extensions use for their stated purposes. For an Azure Functions visualization tool, reading project files and making network calls to Azure services is expected behavior, not suspicious activity.

The credential-related finding (YARA--credential_env_files) does not target actual secrets like .env files, SSH keys, or cloud credentials—it matches any code that references environment variables, which is standard practice for Azure Function development tools that need to read configuration values. There is no evidence of credential theft or workspace file exfiltration.

The strongest counterargument is that all 33 findings have high severity ratings. However, severity calibration is known to be inflated for code-smell findings, and the threat_indicators explicitly show malware-signature: 0, ioc: 0, and obfuscation: 0. The extension has 2,022 users on the VS Code marketplace, suggesting it has been in use without reported malicious behavior. Without specific file paths to analyze, these findings represent expected noise from bundled dependencies rather than evidence of malicious intent.

Key Reasons

• All 33 findings are code-smell category with zero actual malware signatures
• Every finding has unknown_file path indicating bundled/minified code
• YARA rules match known false-positive Node.js patterns
• Extension has legitimate purpose with 2022 users on VS Code marketplace

False Positive Considerations

• Code-smell YARA rules on bundled/minified code
• Unknown file paths preventing specific analysis
• Generic postinstall_* patterns matching legitimate Node.js behavior
• Severity inflation for code-smell findings