StyleGuard Pro

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension "StyleGuard Pro" presents a writing assistant that claims to provide "clear, concise and consistent text." The code structure reveals a tansaclient/ directory containing files like tansa.js, googleDocsAdapter.js, and lingofy/login.js, which align with Tansa's commercial proofreading and grammar checking products.

The findings breakdown tells a clear story. Of the 1085 total findings, 559 are classified as IoCs, 272 are code-smell, 9 are obfuscation, and 3 are network. Zero malware signatures matched anywhere in the extension.

The 559 IoC findings are almost entirely false positives from the extractor. The network endpoints list includes entries like 0-this.offset.relative.top-this.offset.parent.top, bounds.bottom-viewport.top, clientrect.top-eleboundingclientrect.top, and btn-group.open. These are JavaScript property access chains, arithmetic expressions, and CSS class names that the IoC extractor misidentified as domains. The only potentially real domain in the list is ajaxload.info, but without context on how it's used, it's insufficient to draw conclusions.

The 272 code-smell findings are low-severity matches that fire on any non-trivial JavaScript. Rules like postinstall_* match basic Node.js patterns, and credential_* matches any code referencing API keys. These are documented noise sources in the CVEQ platform.

The 9 obfuscation findings concentrate in tansaclient/ files. OBFUSCATION-unicode_heavy triggers in javascript-draft.js and googleDocsAdapter.js, which handle text processing for grammar checking and would naturally contain extensive Unicode handling. OBFUSCATION-dynamic_eval appears in about.js, gui.js, login.js, and tansa.js. While dynamic eval can be concerning, commercial software often uses these techniques for legitimate reasons like dynamic UI generation or configuration loading. Without malware signatures co-located with these obfuscation patterns, they don't indicate malicious intent.

The 3 network findings in js/serviceWorker.js show websocket and fetch calls at lines 1, 15, and 29. These are standard network operations for a writing assistant that needs to communicate with backend services for grammar checking.

The empty developer name and 0 user count are unusual but not conclusive. The extension declares no permissions or host permissions, which actually limits its attack surface. A grammar checker without host_permissions cannot read page content it wasn't explicitly given, reducing the risk of data exfiltration.

A skeptic might argue that the empty developer attribution combined with obfuscation in multiple files indicates a malicious actor hiding their identity. However, the absence of malware signatures, the presence of legitimate commercial code paths (tansaclient/), and the complete lack of suspicious domains in the IoC list undermine that interpretation. The findings are driven by known false positive patterns: IoC extractor garbage, code-smell noise, and obfuscation detection in commercial software.

Key Reasons

• 559 IoCs are almost entirely JavaScript property access and CSS class names, not real domains
• Zero malware signatures matched in the entire extension
• Obfuscation findings are in tansaclient directory, suggesting legitimate commercial proofreading software
• No permissions or host permissions declared, limiting attack surface
• Network endpoints are generic fetch and websocket calls without suspicious destinations

False Positive Considerations

• IoC extractor misidentified JavaScript property access chains and CSS class names as domains
• Code-smell rules matched basic JavaScript patterns in non-trivial code
• Obfuscation detector flagged legitimate commercial proofreading software code
• High finding count inflated by bundled dependencies in tansaclient directory

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 75%.