HTML Tag

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The HTML Tag extension for Notepad++ provides text manipulation functions: HTML/XML tag jumping, entity encoding/decoding, and JavaScript character encoding. This purpose justifies read-write access to files within the Notepad++ editor workspace, as the extension must parse and modify HTML/XML content in open documents. The findings summary shows 0 malware signatures, 0 obfuscation findings, 0 secret/credential findings, and 0 network findings—critical indicators that would signal malicious intent are absent.

All 140 IoC findings in the ioc category are GitHub commit URLs pointing to https://github.com/rdipardo/nppHTMLTag/commit/[hash] (e.g., XIOC-URL-https://github.com/rdipardo/nppHTMLTag/commit/34ae163] from extracted_from_files). These are not command-and-control servers, exfiltration endpoints, or suspicious external domains. GitHub is a legitimate version control platform, and embedding commit hashes in plugin metadata or about dialogs is standard practice for open-source attribution. The XIOC extractor misclassifies these benign URLs as medium-severity IoCs, creating false-positive volume without actual threat signal.

The 16 code-smell findings are expected noise on any non-trivial Notepad++ plugin. These rules fire on basic Node.js patterns, standard file operations, and common programming constructs. Without specific evidence of credential theft patterns (reading .env, .git/config, SSH keys, or cloud credentials), these findings carry no security weight. The findings summary confirms 0 secret findings, meaning no code paths access actual secrets or sensitive configuration files.

The strongest counterargument to this verdict is the 0 user count, which could indicate a newly published plugin or lack of adoption tracking. However, user count alone does not determine maliciousness. A second counterargument is the high finding count (163 total), but finding volume is a known false-positive driver in CVEQ analysis. The nature of findings matters more than the count: zero malware signatures, zero obfuscation, and zero credential-access findings outweigh the inflated IoC count from GitHub URLs.

Notepad++ plugins are native DLLs, so any findings in them carry more weight than JavaScript findings in VS Code extensions. However, the absence of malware signatures and obfuscation findings in this DLL-based plugin is significant. The extension's functionality (text manipulation) does not require network access, credential storage, or process execution beyond what Notepad++ already provides. The GitHub URLs in the findings are consistent with legitimate open-source development practices, not supply chain poisoning or data exfiltration.

This extension should be classified as likely_false_positive. The recommended action is suppress_false_positive for the GitHub URL IoCs, as they represent legitimate version attribution, not malicious infrastructure.

Key Reasons

• All 140 IoC findings are GitHub commit URLs for version attribution, not C2 or exfiltration
• Zero malware signatures detected in Notepad++ DLL
• Zero credential/secret findings despite text file access
• Zero obfuscation findings in bundled code
• Extension purpose (HTML/XML manipulation) justifies file read-write access

False Positive Considerations

• XIOC extractor flagging GitHub commit URLs as IoCs
• Code-smell findings on legitimate text manipulation code
• Finding count inflation from benign version attribution strings
• Zero malware signatures despite Notepad++ DLL format

Reviewed 2026-05-03; recommended action: suppress false positive; model confidence 85%.