TubeBuddy for YouTube™

AI Security Review

Evidence context: threat category none; evidence quality moderate.

TubeBuddy for YouTube ships 649 findings in this Edge build, and none of them describe malicious behavior. The breakdown explains why: zero IoCs, zero malware signatures, zero secret findings, zero manifest findings. What remains splits into 344 low-severity code-quality hits and 16 medium or high findings that all trace back to bundled third-party code.

Start with the network findings. Every one of the nine lands inside a recognized front-end library: js/jquery/jquery-3.6.0.js:9969 (jQuery's AJAX transport), js/papaParse/papaparse.js:630 (CSV streaming), js/fabric/fabric.js:2747 (canvas rendering), js/qtip/jquery.qtip.js:347, and js/introjs/introjs.js:10. The remaining four, FetchUtilities.js:150, FetchUtilities.js:262, TubeBuddyAppToExt.js:139 and destBackground.js:5, handle the app-to-extension messaging the product runs on. A YouTube analytics and automation tool that talks to its own backend produces exactly this pattern. None of these findings name a destination domain, and the declared network endpoint list sits empty.

The obfuscation bucket carries the highest severity and the weakest signal. js/moment/moment-with-locales.js triggers OBFUSCATION-invisible_unicode_payload. That file holds month names, weekday names and date formats for every locale moment supports. Writing systems such as Khmer, Sinhala and Farsi use zero-width joiners and non-joiners as ordinary orthography, and a byte-level scanner cannot tell a Khmer syllable from a hidden instruction. The five OBFUSCATION-unicode_heavy hits on js/raphael/raphael.js, js/twitter-text/twitter-text.js, js/twittertext/twitter-text.js, tubebuddymaster1.js and tubebuddymaster4.js follow the same logic: vector-graphics code and tweet-parsing code both ship large strings covering wide character ranges. OBFUSCATION-malicious_import on js/raphael/raphael.js tags a library that has sat on npm since 2009.

A skeptic would point out that the developer name field sits empty and that TubeBuddy sells a paid tier, which makes a monetized publisher worth a second look. The extension also automates interactions with YouTube on the user's behalf, and automation supplies the raw material for both useful tools and abusive ones. That concern has merit, and the analysis would read differently if the permission lists actually contained entries. It does not. Nothing here reaches credentials, cookies, or a named remote host, and nothing matches a malware signature. An empty publisher field in this data set usually means the store scrape missed the value, and the public Edge and Chrome listings for TubeBuddy name the company and link to its site.

For a malicious reading to hold, one of these findings would need to survive inspection on its own terms. None does. Every high-severity item sits on a library with a public source repository and a published changelog. The code-quality rules behind the 344 low hits fire on fetch, exec, crypto and environment-variable references, and those patterns live in every JavaScript bundle of this size. More scanning would not change the picture: the extension requests no permissions and names no endpoints it could abuse.

Key Reasons

• Zero IoCs, zero malware signatures and zero secret or manifest findings across 649 total findings
• All nine network findings sit inside recognized front-end libraries (js/jquery/jquery-3.6.0.js:9969, js/papaParse/papaparse.js:630, js/fabric/fabric.js:2747, js/qtip/jquery.qtip.js:347, js/introjs/introjs.js:10) plus the app-to-extension bridge in FetchUtilities.js and TubeBuddyAppToExt.js
• OBFUSCATION-invisible_unicode_payload fires on js/moment/moment-with-locales.js, a locale data file where zero-width characters belong to Khmer, Sinhala and Farsi orthography
• OBFUSCATION-unicode_heavy and OBFUSCATION-malicious_import fire on raphael.js, twitter-text.js and tubebuddymaster*.js, all of which ship large multi-script string tables
• Empty permissions, empty host_permissions and empty network_endpoints leave no capability that could be misused

False Positive Considerations

• Zero-width unicode in locale and i18n data (js/moment/moment-with-locales.js) misread as steganography
• Bundled third-party libraries (jquery, fabric, papaparse, qtip, introjs, raphael, twitter-text) generating their own network and obfuscation matches
• 344 low-severity code-smell hits from rules that fire on generic JavaScript patterns such as fetch, exec and environment-variable access
• Unicode-heavy string tables in vector-graphics and text-parsing code flagged as obfuscation

Reviewed 2026-10-02; recommended action: suppress false positive; model confidence 85%.