Etna Theme

AI Security Review

Evidence context: threat category none; evidence quality strong.

The Etna Theme extension by Codigrate is a cosmetic theme for JetBrains IDEs. Theme extensions change the visual appearance of the editor through color schemes and UI styling. They have no legitimate need to access the filesystem, execute processes, or read source code. This extension declares no permissions in its manifest and requests no host permissions, which is appropriate for a theme.

The findings consist entirely of 293 IoC detections and 2 low-severity code-smell matches. Every IoC finding points to URLs on codigrate.com, the publisher's own domain. The detected URLs follow the pattern https://codigrate.com/util/color/[HEX].png?width=18&height=18, which are 18x18 pixel color swatch images used for theme preview rendering. Other IoC hits reference https://codigrate.com/tools/color/[HEX] paths and the official JetBrains plugin page at https://plugins.jetbrains.com/plugin/34642-dublin-theme. These are not suspicious network calls. They are static asset URLs that a theme extension would legitimately reference to display color palettes and preview images.

The network endpoints list includes sodipodi.sourceforge.net and www.inkscape.org, which are standard SVG namespace declarations found in vector graphics files. Theme packages often include SVG icons or assets created in Inkscape, and these namespaces are embedded in the SVG XML metadata. This is expected and benign. The plugins.jetbrains.com endpoint is the official marketplace URL.

The two code-smell findings are low-severity matches that fire on basic code patterns. These are explicitly documented as noise sources that match on non-trivial JavaScript but do not indicate malicious behavior.

The strongest counterargument to a benign verdict is the high volume of IoC findings (293 total). However, volume alone does not indicate risk. Every single IoC hit resolves to either the publisher's own domain serving theme assets, standard SVG namespace URLs, or the official JetBrains marketplace. There are zero malware signatures, zero credential-access findings, zero obfuscation detections, and zero evidence of postinstall execution or data exfiltration. The extension does exactly what a theme should do and nothing more.

Key Reasons

• All 293 IoC findings point to publisher's own domain (codigrate.com) serving color swatch images
• Network endpoints are standard SVG namespaces and official JetBrains marketplace
• Zero malware signatures, zero credential access, zero obfuscation
• Extension declares no permissions, appropriate for a theme
• Code-smell findings are documented noise sources

False Positive Considerations

• IoC hits on publisher's own domain serving theme assets
• SVG namespace URLs from Inkscape/Sodipodi in theme graphics
• Official JetBrains marketplace URL detection
• Low-severity code-smell matches on standard patterns

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 92%.