iHomeCoder-Linux

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The iHomeCoder-Linux extension for JetBrains presents a classic case of scanner noise overwhelming actual risk. The analysis shows 14,222 indicators of compromise, but a closer look at the extracted domains reveals they are entirely benign or generic. The network endpoints list includes test environments like 001.test.code-builder-stg.platform.salesforce.com and random short domains such as 0am.jp and 123hjemmeside.dk. These are not active command-and-control servers or data exfiltration endpoints. They are strings embedded within the extension's bundled native runtime, likely pulled from root certificate stores, locale data, or internal test configurations. The indicator of compromise extractor simply parsed the binary and flagged every URL-like string it found.

The single critical finding, titled OBFUSCATION-supply_chain_binary, targets the file iHomeCoder-Linux/runtimes/linux-x64/core/index.node. This file is a compiled Node.js native addon, written in C or C++ and compiled to machine code for Linux x64 architectures. Native addons are standard for extensions that require high performance or direct operating system access. The obfuscation scanner flagged this compiled binary because machine code does not resemble human-readable JavaScript or standard web assembly. This is a standard compiled artifact, not an attempt to hide malicious logic. There are zero malware signatures and zero secret-stealing findings in the entire bundle. The 150 code-smell findings are low-severity matches that fire on standard Node.js patterns and bundled dependencies.

Regarding filesystem and process access, a coding assistant or core engine extension legitimately needs to read workspace files and spawn processes to function. The presence of a native runtime in runtimes/linux-x64/core/ confirms this extension executes compiled code to perform its core tasks. There are no findings indicating the extension reads .env files, SSH keys, or cloud credentials. The credential-access category is completely empty, meaning the extension does not target developer secrets.

The strongest counterargument to clearing this extension is its low user count of 52 and the inclusion of a pre-compiled native binary. A low download count combined with a native payload can sometimes indicate a targeted supply chain attack or a typosquatting attempt. However, the native binary here is structured as a standard runtime component in a dedicated runtimes directory. The massive volume of indicators of compromise is entirely explained by the scanner parsing that exact binary for embedded strings. Without any actual malicious behavior, credential access, or suspicious network callbacks, the findings are entirely attributable to the limitations of static analysis on compiled binaries.

Key Reasons

• Massive IoC count stems from generic domains and test URLs extracted from a bundled native binary
• Critical obfuscation finding targets a compiled C/C++ .node addon, triggering binary analysis heuristics
• Zero malware signatures or secret-stealing findings detected in the bundle
• Code-smell findings are low-severity noise typical of bundled dependencies

False Positive Considerations

• IoC extractor parsing compiled native binary for certificate and test URLs
• Obfuscation scanner flagging compiled C/C++ .node addon as obfuscated
• Code-smell rules matching bundled dependency patterns

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 85%.