Ocultalo

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension 'Ocultalo' claims to hide sensitive data during live streams, a legitimate privacy use case. Analysis of the 39 total findings reveals no evidence of malicious behavior. The 33 IoC findings are dominated by benign infrastructure: pki.goog and clients2.google.com are Google PKI/CDN domains (documented false positive sources), :: is an IPv6 loopback fragment (known XIOC garbage pattern), and ejemplo.com is a placeholder domain. The developer's own domain miqueasrogelio.com appears in findings, which is expected for legitimate extensions referencing their website. The WhatsApp link https://wa.me/51950064470 is a support contact, not exfiltration infrastructure.

The 6 code-smell findings are all low severity, matching the documented noise profile (postinstall_*, credential_*, code-quality rules). Critically, there are ZERO malware signatures, ZERO obfuscation findings, and ZERO network findings. The absence of obfuscation is particularly significant—malicious extensions typically employ code obfuscation to hide their behavior. The extension has no high or critical severity findings.

The strongest counterargument is the anonymous developer profile: the developer name is an email address ([email protected]) rather than a company, and user count is 0. However, this alone does not indicate malicious intent. Small developers and new extensions commonly have this profile. Without malware signatures, obfuscation, or suspicious data exfiltration patterns, the developer anonymity is insufficient to override the benign nature of all actual findings. The IoC domains do not match credential theft patterns (no banking/login domains), browser hijacking patterns (no search engine domains), or proxyware patterns (no VPN relay domains).

The verdict is likely_false_positive because the finding volume is driven by known FP patterns (Google infrastructure, IPv6 garbage, example domains) rather than malicious indicators. The extension's stated purpose matches its behavior profile.

Key Reasons

• Zero malware signatures and zero obfuscation findings
• IoC domains are benign infrastructure (Google PKI, CDN) and developer-owned
• IPv6 loopback (::) is documented XIOC false positive pattern
• Code-smell findings are low-severity noise patterns
• No suspicious network activity or data exfiltration indicators

False Positive Considerations

• Google infrastructure domains (pki.goog, clients2.google.com)
• IPv6 loopback fragment (::)
• Example/test domains (ejemplo.com)
• Code-smell low-severity rules

Reviewed 2026-04-28; recommended action: suppress false positive; model confidence 82%.