Post Translator for TWITTER X.COM

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-05-24. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive. Evidence context: threat category none; evidence quality strong.

The Post Translator for TWITTER X.COM extension presents a classic false-positive scenario. While automated scanning generated 30 findings with 29 marked high severity, the nature of these findings reveals they stem from well-documented false-positive patterns rather than actual malicious behavior.

All malware-signature findings originate from YARA rules in the postinstall_* family, which are known to fire on basic JavaScript patterns. For example, YARA--postinstall_persistence_mechanism triggered in font files like /font/Nunito/Nunito-Light.ttf and /font/Nunito/Nunito-Bold.ttf. Binary font files cannot contain executable persistence mechanisms—this is a scanner artifact. Similarly, YARA--SQLInjection matched in /popup/main.js and /js/jquery.js, but SQL injection rules are code-quality checks that trigger on any JavaScript referencing database-like patterns, not actual vulnerabilities.

The code-smell findings include YARA--postinstall_file_manipulation in /popup/main.js and YARA--postinstall_obfuscation in /js/jquery.js. These are bundled dependencies (jQuery is a standard npm package) that trigger their own YARA matches, creating multiplicative false positives. The single network finding shows a jQuery AJAX call in js/cmain.js:123, which is expected behavior for a translation extension that needs to fetch and process tweet content.

The strongest counterargument would be the high severity count (29 high, 1 medium). However, severity ratings in automated scanners don't reflect actual risk when the underlying rules are known false positives. The postinstall_* rules are explicitly documented as matching basic Node.js patterns that appear in legitimate code. The SQLInjection rule is a code-quality check, not a malware detector. The fact that these rules fired in font files (.ttf) proves they're not detecting actual malicious behavior—binary files cannot contain JavaScript-based persistence mechanisms.

The extension's purpose (translating tweets) aligns with its behavior (AJAX calls for content fetching). There are no suspicious domains, no obfuscation findings, no credential theft indicators, and no browser hijacking behavior. The developer uses an email address rather than a company name, which is common for small extensions but doesn't indicate malicious intent. This extension should be classified as benign with the findings suppressed as false positives.

Key Reasons

• All malware-signature findings are from documented postinstall_* false-positive rules
• YARA matches in binary .ttf files prove scanner artifacts, not real threats
• SQLInjection rule is a code-quality check, not malware detection
• Single network finding is normal jQuery AJAX for translation functionality
• No suspicious domains, obfuscation, or credential theft indicators

False Positive Considerations

• postinstall_* YARA rules matching basic JS patterns
• SQLInjection code-quality rule in bundled jQuery
• YARA matches in binary .ttf font files
• Bundled dependency (jquery.js) triggering multiplicative findings