Aircraft Overhead

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Security Analysis: Aircraft Overhead Extension

This extension implements flight tracking functionality using public aviation data APIs. The evidence demonstrates legitimate operational behavior with findings driven by known false positive patterns.

Network Infrastructure Analysis

The extension's network findings connect to legitimate aviation data providers. The finding XIOC-URL-https://opensky-network.org/api/states/all' integrates with OpenSky Network, a recognized flight tracking data service. The email [email protected] confirms legitimate API usage. The extension's own API endpoint XIOC-DOMAIN-api.airplanes.live and website XIOC-URL-https://airplanes.live) represent the service's infrastructure. The Google Chrome update service XIOC-URL-https://clients2.google.com/service/update2/crx is standard browser extension infrastructure.

False Positive Patterns Identified

Several IoC findings represent known XIOC extractor false positives. The domains XIOC-DOMAIN-state.lat, XIOC-DOMAIN-planes.map, XIOC-DOMAIN-aclist.map, XIOC-DOMAIN-ac.lat, and XIOC-DOMAIN-data.ac follow the property access chain pattern where JavaScript property access like state.latitude gets misread as domain state.lat. The findings_summary shows 16 code-smell findings with zero malware signatures and zero obfuscation detections, indicating basic JavaScript patterns rather than malicious behavior.

Developer Attribution

The developer email [email protected] provides minimal attribution but does not indicate impersonation of a known brand. The extension name "Aircraft Overhead" does not mimic any established flight tracking extension.

Counterargument Assessment

A skeptic might argue the zero user count combined with anonymous developer attribution and 48 IoC findings warrants concern. The IoC count alone is meaningless without examining the nature of findings. All network destinations are legitimate aviation APIs or Google infrastructure. No malware signatures exist. No obfuscation is present. The code-smell findings are classified as low severity and match known benign patterns. The extension's description matches its actual behavior (flight tracking), unlike typical malicious extensions that misrepresent functionality.

Verdict Justification

This extension exhibits characteristics of a legitimate flight tracking tool with findings inflated by known false positive patterns. The absence of malware signatures, obfuscation, and the presence of legitimate API integrations outweigh the high finding count.

Key Reasons

• Zero malware signatures in findings
• Zero obfuscation detections
• All network destinations are legitimate APIs (OpenSky Network, Google)
• Property access chain domains are known XIOC false positives
• Extension description matches actual flight tracking functionality

False Positive Considerations

• Property access chains misread as domains (state.lat, planes.map)
• Code-smell findings from basic JavaScript patterns
• Legitimate API endpoints flagged as suspicious IoCs
• Google Chrome update service flagged as IoC

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 85%.