Web Risk Scanner

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Web Risk Scanner (v1.1.0) is a Chrome extension claiming to "analyze the current website and show a live safety score." The evidence bundle contains 94 total findings, but the nature of these findings reveals they are primarily false positives rather than indicators of malicious behavior.

The 81 IoC findings reference legitimate, well-known domains: www.wikipedia.org, www.reddit.com, www.x.com, www.twitter.com, www.instagram.com, www.youtube.com, mail.google.com, docs.google.com, and drive.google.com. These domains are consistent with the extension's stated purpose of analyzing website safety—a safety scanner would legitimately need to reference or check these popular sites. The finding XIOC-IP-e2:: is an IPv6 fragment, a documented false positive from the CVEQ IoC extractor that matches hex substrings in minified JavaScript rather than real IP addresses.

The 12 code-smell findings are all low-severity and represent standard JavaScript patterns that trigger YARA rules on almost any non-trivial code. There are zero malware signatures, zero obfuscation findings, and zero network findings indicating data exfiltration. The single gameograf.com domain reference is the only non-obvious domain, but without additional context or malicious behavior evidence, it does not constitute a security threat on its own.

Counterargument consideration: A skeptic might argue that the developer uses only an email address ([email protected]) rather than a verified company name, and the extension has only 9 users, which could indicate obscurity or anonymity. However, these factors alone do not indicate malicious intent. The absence of malware signatures, obfuscation, credential theft patterns, browser hijacking behavior, or data exfiltration findings is decisive. The extension's behavior—referencing legitimate domains for safety analysis—matches its declared purpose. The high finding count is explained by known CVEQ false positive patterns: the IoC extractor generates massive false-positive volumes from legitimate domain references, and code-smell rules fire on standard JavaScript.

This extension does not exhibit the hallmarks of confirmed malicious extensions: no typosquatting, no credential theft, no malware delivery, no proxyware functionality, and no obfuscated payloads. The findings are noise, not threats.

Key Reasons

• Zero malware signatures or obfuscation findings
• IoC domains are legitimate sites consistent with safety scanner purpose
• IPv6 fragment e2:: is known false positive pattern
• Code-smell findings are low-severity noise on standard JavaScript

False Positive Considerations

• IoC extractor matching legitimate domain references
• IPv6 fragment false positive (e2::)
• Code-smell rules firing on standard JavaScript patterns

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 75%.