DesignHub
The AI review rates the findings as likely false positive, but the risk score (47/100) still counts them.
Analysis record
- Analysed
- 1 months ago
- Version
- v1.0.9
- Artifact
- SHA256 4CA…0D0
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
Requested Permissions
4 permissionsRead and modify cookies on all sites
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The DesignHub extension (version 1.0.9, 5,000 users) presents as a design search tool with network endpoints including 99designs.com, behance.net, dribbble.com, and its own designhubapp.com subdomains (searching.designhubapp.com, suggesting.designhubapp.com). The single network finding at core/search-service.js:37:0 corresponds to a fetch call to one of these legitimate endpoints. The developer is identified as [email protected] with description 'Search By DesignHub'.
All 36 findings fall into two known false-positive categories documented in the CVEQ platform: 21 code-smell findings (classified as low severity) and 14 IoC findings (medium severity). The code-smell findings match YARA rules like postinstall_* and credential_* that fire on standard Node.js patterns (fetch, exec, fs, crypto, process.env) in any non-trivial JavaScript. The IoC findings likely represent IPv6 fragments (::, ::b), loopback addresses (127.0.0.1), property access chains misread as domains (b.call, h.next), or CDN domains — all documented as extractor garbage. No malware signatures, obfuscation, or tool-poisoning findings exist.
The strongest counterargument would be that the extension declares no permissions yet makes network requests. However, requests to the extension's own domains (designhubapp.com) and major design platforms may use optional permissions or standard web APIs not requiring host_permissions. The endpoint list aligns exactly with a design search tool's expected behavior. The modest user count (5,000), clear developer attribution, and category-consistent functionality further support legitimacy.
Key Reasons
- All findings are documented false-positive patterns (code-smell, IoC garbage)
- No malware signatures, obfuscation, or suspicious behavior indicators
- Network endpoints match legitimate design platforms and extension's own domain
- Clear developer attribution and category-consistent functionality
False Positive Considerations
- code-smell findings (21)
- IoC extractor garbage (14 IOCs)
- bundled dependencies likely present
Reviewed 2026-09-26; recommended action: suppress false positive; model confidence 85%.
Chrome version history
Risk trend by version
2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace