HTML Tag

AI Security Review

Evidence context: threat category none; evidence quality strong.

The HTML Tag extension for Notepad++ provides legitimate text editor functionality: HTML/XML tag navigation, entity encoding/decoding, and JavaScript character encoding. The evidence contains no findings indicating malicious behavior.

Filesystem and Process Access: The findings summary shows 0 manifest-analysis findings, 0 network findings, and 0 malware findings. There are no process execution findings in the evidence (no child_process.exec patterns), no postinstall payload execution findings, and no findings indicating the extension accesses files beyond what's required for text editing operations. The extension's stated purpose—HTML tag manipulation—does not require elevated privileges or suspicious access patterns, and the evidence confirms no such patterns exist.

Credential Access: The findings summary explicitly shows 0 secret findings and 0 credential-related findings. There are no findings targeting .env files, .ssh directories, cloud credentials, or IDE secret storage. The evidence contains no credential-access findings whatsoever, which is consistent with a text manipulation tool that has no legitimate reason to access sensitive configuration files.

Counterargument Analysis: The most concerning aspect of this scan is the total finding count of 160, which might suggest widespread malicious indicators. However, examining the nature of these findings reveals they are entirely benign. Of the 160 total findings, 137 are IoC findings, all of which are GitHub commit URLs such as XIOC-URL-https://github.com/rdipardo/nppHTMLTag/commit/86211bd] and XIOC-URL-https://github.com/notepad-plus-plus/notepad-plus-plus/commit/db3308329bd23a073b7de6f4ded2a523b282fcc3#diff-8968b5cad4cc8f62c9204894eea9941dac353af428a26be64f52055e99992040. These are source code references and version control links embedded in the extension's code, not malicious network destinations. The remaining 16 findings are code-smell findings (severity: low), which per CVEQ's documented false positive patterns are expected noise from standard JavaScript patterns like basic Node.js function calls.

The evidence shows 0 malware-signature findings, 0 obfuscation findings, 0 dependency findings, and 0 tool-poisoning findings. The XIOC extractor's known false positive pattern of extracting GitHub URLs as IoCs explains the inflated finding count. The extension's functionality aligns with its description, there are no capability findings beyond stated purpose, and the findings are consistent with legitimate development tool patterns. This is a false positive driven by IoC extractor noise (GitHub URLs misidentified as indicators) and code-smell YARA findings (low-severity JavaScript pattern matches).

Key Reasons

• All 137 IoC findings are GitHub commit URLs, not malicious network indicators
• Zero malware, secret, or obfuscation findings in evidence
• 16 code-smell findings are low-severity YARA noise per documented false positive patterns
• Extension functionality matches stated purpose with no capability beyond scope
• No process execution or credential access findings

False Positive Considerations

• XIOC GitHub URL extraction (137 findings are commit references, not network indicators)
• Code-smell YARA findings (16 low-severity JavaScript pattern matches)
• Finding count inflation from benign source code references

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 92%.