TASKING winIDEA

AI Security Review

Evidence context: threat category unknown malware; evidence quality strong.

The extension’s native code is the main concern. si.isystem.clion.debug/res/IConnectJNIx64.dll and si.isystem.clion.debug/res/libiconnectJava.so are packaged native binaries, so they can run with the privileges available to the JetBrains process and can access local files, processes, and network services when invoked. That capability fits a hardware or debugger integration only if the binaries implement the stated TASKING winIDEA function, yet the package has no stated description linking either binary to a debugger, compiler, or device workflow. The finding titled YARA--EclipseSunCloudRAT matches both native files, which is a direct malware-family signal rather than a generic JavaScript code smell.

The same two files are each marked OBFUSCATION-supply_chain_binary, at si.isystem.clion.debug/res/IConnectJNIx64.dll:0 and si.isystem.clion.debug/res/libiconnectJava.so:0. Obfuscation in native binaries can have legitimate reasons, such as protecting vendor code, but that explanation is weak when both files also receive the YARA--EclipseSunCloudRAT match. The endpoint list includes alloc.cc, connection.ws, cfg.bank, and clogger.java; those names are unusual for a development debugger and add to the concern around the native components. The available findings do not identify .env, .ssh, cloud credential files, IDE secret storage, or any other actual secret path. They also do not show a credential-theft finding. That limits the claim to suspicious native payloads and possible network activity, rather than proven credential theft.

The strongest counterargument is that YARA signatures can match shared code, and the two obfuscation findings can result from ordinary compiled vendor binaries. The endpoint strings can also be false positives from binary or symbol extraction, especially because alloc.cc and clogger.java are short names. That argument does not resolve the paired signals in IConnectJNIx64.dll and libiconnectJava.so: the same specific YARA--EclipseSunCloudRAT title occurs in both files, and each file is independently marked OBFUSCATION-supply_chain_binary. The package has 1,018 users, but the user count at version 921.40800.258814 does not validate native code or explain the malware-family matches. Native binaries in a JetBrains plugin deserve runtime isolation and publisher verification before continued distribution.

Key Reasons

• YARA--EclipseSunCloudRAT matches both si.isystem.clion.debug/res/IConnectJNIx64.dll:13416 and si.isystem.clion.debug/res/libiconnectJava.so:11837.
• OBFUSCATION-supply_chain_binary marks both native files at their file starts.
• Unusual extracted endpoints include alloc.cc, connection.ws, cfg.bank, and clogger.java.
• No listed finding identifies .env, .ssh, cloud credentials, or IDE secret storage.

False Positive Considerations

• YARA matches can occur on shared native-library code, including YARA--EclipseSunCloudRAT.
• OBFUSCATION-supply_chain_binary can flag legitimate compiled vendor binaries.
• Short endpoint strings such as alloc.cc and clogger.java can result from binary extraction.
• Native files can contain packed or optimized code that resembles obfuscation.

Reviewed 2026-09-30; recommended action: escalate; model confidence 90%.