Hexana WebAssembly and Native (ELF/PE/Mach-O) Hex Viewer

AI Security Review

Evidence context: threat category none; evidence quality weak.

The Hexana WebAssembly and Hex Viewer extension is designed for binary and WebAssembly file analysis, which legitimately requires filesystem read access. The extension's stated purpose as a hex viewer justifies workspace file reads for displaying binary content, and no postinstall payload execution or credential theft patterns were detected in the evidence.

All 150 IoC findings are XIOC extractor false positives that misinterpret JavaScript property access chains as domain names. The finding XIOC-DOMAIN-function.is is the JavaScript expression function.is (property access), not a domain. Similarly, XIOC-DOMAIN-thread.new is the expression thread.new, XIOC-DOMAIN-future.read is future.read, and XIOC-DOMAIN-self.control.is is self.control.is. The findings XIOC-DOMAIN-lanev128.store, XIOC-DOMAIN-mini32x4.dot, and XIOC-DOMAIN-splatv128.store follow the same pattern where .store, .dot, and .lt are JavaScript property access operators, not top-level domains. These property access chains are documented XIOC false-positive patterns that occur in any non-trivial JavaScript codebase.

The single obfuscation finding OBFUSCATION-LARGE_BASE64-extension/out/webviewContent.js-1 in extension/out/webviewContent.js is expected behavior for bundled webview JavaScript. Webview content in IDE extensions commonly contains base64-encoded assets, icons, and bundled dependencies. This is build output from webpack or similar bundlers, not intentional obfuscation to hide malicious code.

No credential-access findings exist in this bundle (secret count is 0). The extension does not access .env files, .ssh directories, cloud credentials, or VS Code secret storage. There are no credential_* YARA findings or secret extraction patterns detected.

The strongest counterargument is the suspicious metadata: the extension claims JetBrains as the developer but has 0 users and version 0.0.2, which is atypical for an official JetBrains product. This could indicate a typosquat or unauthorized re-upload. However, the actual code findings contain no malicious behavior. The XIOC false positives and webview base64 patterns are consistent with legitimate IDE extensions. Without evidence of postinstall payload execution, credential theft, or data exfiltration, the metadata concern alone does not warrant a malicious verdict. The code itself shows no indicators of harmful intent.

The findings are entirely explainable as XIOC garbage and expected bundling artifacts. No action is required beyond suppressing these false positives.

Key Reasons

• All 150 IoC findings are XIOC false positives (property access chains like function.is, thread.new, future.read)
• Obfuscation finding is expected for bundled webview JavaScript in extension/out/webviewContent.js
• No postinstall payload execution or credential theft patterns detected
• Zero credential/secret findings in the evidence bundle
• No actual malicious code behavior identified

False Positive Considerations

• XIOC property access chain misinterpretation (function.is, thread.new, future.read)
• Large base64 in bundled webview JavaScript (extension/out/webviewContent.js)
• JavaScript property access patterns misread as TLDs (.store, .dot, .lt)

Reviewed 2026-05-07; recommended action: suppress false positive; model confidence 85%.