LSP4IJ

AI Security Review

Evidence context: threat category none; evidence quality strong.

LSP4IJ is a language server extension distributed through the verified JetBrains marketplace and published by Red Hat. The evidence shows 24 findings, all classified as metadata entries such as HASH-cdf82d26e112e96a in lsp4ij/lib/flexmark-ext-tables-0.64.8.jar and HASH-1e24c891dac9532b in lsp4ij/lib/flexmark-util-0.64.8.jar. No postinstall payload execution, no child process spawns, and no network calls beyond the normal language server protocol are present. The extension does not contain any IoC addresses, malware signatures, or obfuscation patterns that would suggest malicious intent. All findings are confined to bundled library metadata, which is typical for extensions that include dependent JAR files for core functionality such as markdown parsing. Because the extension’s purpose is to provide language support for JSON-like syntaxes, the modest file reads it performs are justified and match the normal operational profile of a language server. No credential‑access findings reference .env files, SSH keys, or cloud credential stores; the secret category is empty. The strongest counterargument is that a language server could theoretically scan arbitrary workspace files, but the evidence shows no anomalous file reads or writes beyond the expected project‑level access, and no data exfiltration attempts are recorded. Accordingly, the extension’s behavior aligns with legitimate development tooling rather than hostile activity.

In summary, the extension’s design and the nature of the recorded findings confirm that it operates within the scope of its stated purpose as a language server, with no evidence of malicious exfiltration, credential theft, or supply‑chain manipulation.

Top reasons for this verdict include: only metadata findings are present; no postinstall or credential‑access indicators; the extension is published by a verified Red Hat publisher on a trusted marketplace; a high user count of 73,294 suggests community validation; and the findings originate from bundled dependencies rather than the extension’s own code.

Key Reasons

• Only metadata findings
• No postinstall or credential access
• Extension is from verified Red Hat publisher
• High user count suggests legitimacy
• Findings stem from bundled libraries

False Positive Considerations

• metadata findings
• bundled dependencies
• official Red Hat publisher
• high user count

Reviewed 2026-05-23; recommended action: no action; model confidence 95%.