Granite.Code

AI Security Review

Evidence context: threat category none; evidence quality strong.

The filesystem and process access implied by this package is consistent with a local coding assistant. The native files extension/bin/napi-v3/win32/x64/onnxruntime.dll, extension/bin/napi-v3/win32/x64/onnxruntime_binding.node, and extension/bin/napi-v3/win32/x64/onnxruntime_providers_shared.dll are ONNX Runtime components, which fit local model inference. The parser files extension/out/tree-sitter-wasms/tree-sitter-typescript.wasm, extension/out/tree-sitter-wasms/tree-sitter-bash.wasm, and extension/out/tree-sitter-wasms/tree-sitter-python.wasm would support source parsing across languages. Those files explain why the extension needs access to workspace code and may start native or WebAssembly components. The supplied manifest data lists no permissions or host permissions, and no finding names a postinstall action, command execution, or destructive file write.

The network findings also fit the packaged user interface and local service plumbing. NET-XMLHTTPREQUEST-extension/out/xhr-sync-worker.js-9 identifies XMLHttpRequest use in an XHR worker, while NET-SOCKET_IO-extension/gui/assets/cytoscape.esm.js-8 identifies Socket.IO-related code inside a graph UI dependency. The listed endpoint 001.test.code-builder-stg.platform.salesforce.com is a staging-style development hostname. The other listed domains, including 0-i.top, 001www.com, and 123website.be, are endpoint-extractor results without a matching data-flow finding or a file path showing secret or source-code upload. Domain extraction alone does not establish exfiltration.

Credential access is absent from the supplied findings. No finding names .env, .ssh, cloud credential files, VS Code secret storage, or a credential provider. The native ONNX files named by OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/napi-v3/win32/x64/onnxruntime.dll-0 and OBFUSCATION-NATIVE_BINARY_ADDON-extension/bin/napi-v3/win32/x64/onnxruntime_binding.node-0 describe binary format characteristics, not secret collection. The JavaScript findings OBFUSCATION-UNICODE_HEAVY-extension/gui/assets/index.js-420 and OBFUSCATION-HEX_STRING_HEAVY-extension/out/index.js-247977 concern bundled output, where generated or minified code commonly triggers scanner rules. The large WASM findings for extension/out/tree-sitter-wasms/tree-sitter-ruby.wasm and extension/out/tree-sitter-wasms/tree-sitter-swift.wasm likewise fit parser assets.

The strongest counterargument is that native binaries and network code give an extension meaningful power. extension/bin/napi-v3/win32/x64/onnxruntime_binding.node can run native inference, and extension/out/xhr-sync-worker.js can make network requests. That concern does not change the conclusion because the supplied results contain zero malware-signature findings, zero secret findings, and zero tool-poisoning findings, while the named binaries and parser assets match the stated local-AI coding function. Runtime inspection would still be needed to verify what data the XHR worker sends, since the endpoint list alone does not show request contents.

Key Reasons

• extension/bin/napi-v3/win32/x64/onnxruntime.dll and extension/bin/napi-v3/win32/x64/onnxruntime_binding.node match local AI inference components.
• extension/out/tree-sitter-wasms/tree-sitter-typescript.wasm and related parser files match source-code analysis.
• NET-XMLHTTPREQUEST-extension/out/xhr-sync-worker.js-9 shows network capability without a paired exfiltration or credential finding.
• No supplied finding names secrets, malware signatures, tool poisoning, or postinstall execution.

False Positive Considerations

• Native binary detection on extension/bin/napi-v3/win32/x64/onnxruntime.dll and related ONNX files.
• Large WASM detection on extension/out/tree-sitter-wasms/*.wasm parser assets.
• Unicode and hex-pattern detections in bundled files such as extension/gui/assets/index.js and extension/out/index.js.
• IoC extraction from generic or unrelated domains such as 0-i.top and 123website.be.

Reviewed 2026-09-29; recommended action: suppress false positive; model confidence 88%.