DotVVM

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-09-06. The review verdict is likely false positive with 80% confidence.

Recommended action: suppress false positive. Evidence context: threat category none; evidence quality weak.

DotVVM is a known open-source .NET MVVM framework, and this JetBrains extension provides IDE support for it. The findings mostly reflect extractor noise and do not show malicious behavior.

The 298 IoC findings are almost entirely XIOC artifacts. Titles such as XIOC-DOMAIN-visitedobjects.save, XIOC-DOMAIN-t.download, XIOC-DOMAIN-niedozwolone.ky, XIOC-DOMAIN-array.map, XIOC-DOMAIN-c.gd, and XIOC-DOMAIN-d.ua are property-access chains and short strings from minified JavaScript. They do not represent real domains. The IP findings 3.3.3.0 and 4.0.0.0 look like version fragments. They cannot be routed as endpoints. Only one URL appears: https://www.dotvvm.com/docs/tutorials/advanced-ioc-di-container-owin/2.0. That URL points to the official DotVVM documentation, exactly what a legitimate framework plugin would reference. The IoC findings do not include specific source file paths, which is typical of extractor output from minified bundles. The titles read as code fragments rather than network destinations. The absence of file paths reinforces that origin. The extractor pulled these strings from bundled code. This pattern matches minified JavaScript resources.

The scan produced no secret findings, no network findings, and no manifest-analysis findings. The evidence shows no attempt to read .env files, SSH keys, cloud credentials, or other secrets, and it shows no excessive permission requests. The extension's purpose as a DotVVM development tool justifies project file access for IntelliSense, code generation, and template processing. No finding contradicts that scope. The extension does not request network access or secret storage.

All 105 obfuscation findings carry critical severity. They lack specific file paths and match minified or bundled JavaScript resources that ship with many IDE extensions. The extension ships minified JavaScript. Six malware-signature findings carry high severity. They come with no actual malware category and no specific malicious file path. Broad YARA rules likely match common .NET or JavaScript patterns. Sixty-nine code-smell findings carry low severity and are typical of non-trivial codebases. These patterns occur in many legitimate IDE extensions.

A counterargument combines critical obfuscation findings, high malware-signature findings, a low user count of 9, and a developer name (keeper7) that is not the official DotVVM organization. However, the obfuscation and malware-signature findings are not tied to any specific malicious behavior. The IoCs are all extractor artifacts. The only concrete URL is the framework's own documentation. The developer name and low user count raise caution, but they do not establish malicious intent. This does not change the conclusion that the findings are false positives from bundled code and automated extractors.

Key Reasons

• All 298 IoC findings are XIOC extractor artifacts: property-access chains (array.map, propinfo.post), short strings (c.gd, d.ua), and version-like IPs (3.3.3.0, 4.0.0.0), not real network indicators.
• The only URL is the official DotVVM documentation page, consistent with a legitimate framework plugin.
• No secret, network, or manifest-analysis findings; no evidence of credential access or excessive permissions.
• 105 obfuscation and 6 malware-signature findings are consistent with minified/bundled code and broad YARA rules, with no specific malicious file paths.
• Extension name and purpose (DotVVM for JetBrains) match a known open-source .NET framework.

False Positive Considerations

• XIOC extractor garbage: property-access chains and short strings misread as domains/IPs
• Minified/bundled JavaScript triggering obfuscation rules
• Broad YARA malware-signature rules matching common .NET/JS patterns
• Code-smell findings from standard framework code