Wallaby

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The Wallaby extension from Wallaby Team on the JetBrains marketplace shows no actual security concerns. All nine findings in the analysis are metadata hashes of bundled JAR dependencies located in the wallaby-intellij/lib/ directory. These include standard libraries such as kotlin-stdlib-2.2.0.jar, rxjava-3.1.8.jar, Java-WebSocket-1.5.3.jar, reactive-streams-1.0.4.jar, annotations-13.0.jar, slf4j-simple-2.0.6.jar, and slf4j-api-2.0.6.jar, plus the main extension JARs wallaby-intellij-1.0.347.jar and wallaby-intellij-1.0.347-searchableOptions.jar. These metadata findings are not security detections—they are simply package identifiers for legitimate dependencies that JetBrains extensions commonly bundle.

The extension's filesystem access is justified by its stated purpose as a test runner. Wallaby executes tests against source code, which requires reading project files and writing test results. The bundled dependencies support this functionality: rxjava-3.1.8.jar enables asynchronous test execution, Java-WebSocket-1.5.3.jar provides communication capabilities, and slf4j libraries handle logging. No credential-access findings target actual secrets such as .env files, .ssh directories, or cloud credentials. The metadata findings only reference JAR file hashes, not any sensitive configuration files or authentication tokens.

The strongest counterargument might be that bundled dependencies could theoretically contain malicious code. This concern does not apply here because the dependencies are standard, well-known libraries from public repositories, there are zero malware signatures detected in any bundled JARs, there are zero network indicators suggesting exfiltration behavior, and the extension has 130,195 users on the JetBrains marketplace indicating widespread adoption without reported security incidents. With zero IoC matches, zero malware signatures, zero obfuscation findings, and zero code-smell detections, this extension demonstrates the expected profile of a legitimate development tool. The metadata hashes are informational only and represent normal dependency packaging, not security concerns.

Key Reasons

• All findings are metadata hashes of legitimate bundled dependencies
• Zero malware signatures, IoC matches, or obfuscation findings
• 130,195 users indicate widespread legitimate adoption
• Standard test runner extension with justified file access

False Positive Considerations

• Bundled JAR dependencies in lib/ directory
• Metadata hashes are not security findings
• No actual threat indicators present

Reviewed 2026-05-23; recommended action: no action; model confidence 95%.