LeetCode with Auth Sync

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Filesystem and Process Access

The extension’s source includes a typical Node.js dependency tree (e.g., extension/node_modules/htmlparser2/lib/FeedHandler.js, extension/node_modules/axios/lib/axios.js, and extension/node_modules/lodash/lodash.min.js). The only observable actions are HTTP requests made via fetch, axios, and XMLHttpRequest – all standard ways to retrieve HTML pages or API data needed for LeetCode problem scraping. There is no evidence of child‑process spawning, exec calls, or file‑system writes outside of normal workspace interaction, so the filesystem/process access observed is consistent with the extension’s purpose of syncing problem data.

Credential‑Access Findings

The evidence bundle does not contain any secret‑type findings. No files such as .env, .git/config, or SSH keys are read, and no VS Code secret‑storage APIs are invoked. The network calls are limited to external URLs required for the LeetCode web interface, and the extension does not attempt to collect or transmit user credentials.

Counterargument and Why It Does Not Change the Verdict

One could argue that the massive count of IoC entries (21,155) indicates systematic exfiltration of data. In practice, these IoCs are generated by the XIOC extractor from the minified JavaScript bundled in the node_modules directory; many entries are generic substrings (e.g., domain‑like strings, IPv6 fragments) that appear in any third‑party library. The CVEQ platform’s known false‑positive patterns note that IoC volume alone is meaningless, and the specific findings—such as NET-AXIOS-extension/node_modules/axios/lib/axios.js-70—are benign library calls. Therefore, the sheer number of IoCs does not imply malicious intent.

Conclusion: The extension’s behavior aligns with its advertised functionality (LeetCode problem synchronization), and no malicious patterns such as post‑install payloads, credential theft, or unwarranted system commands are present.

Relevant findings: NET-FETCH-extension/node_modules/htmlparser2/lib/FeedHandler.js-61, NET-AXIOS-extension/node_modules/axios/lib/axios.js-82, NET-XMLHTTPREQUEST-extension/node_modules/axios/lib/adapters/xhr.js-35, NET-SOCKET_IO-extension/node_modules/lodash/lodash.min.js-71.

Key Reasons

• All network calls originate from standard bundled libraries (fetch, axios, socket_io).
• No credential‑related findings were reported.
• High IoC count is explained by bundled dependencies and known false‑positive patterns.

False Positive Considerations

• bundled dependencies generating many IoCs
• IoC extractor generic matches
• code‑smell YARA rules (none triggered)
• large count of findings in dist/ libraries

Reviewed 2026-05-31; recommended action: monitor; model confidence 84%.