Kei - API Contract Testing

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Kei - API Contract Testing is a JetBrains extension published by Jakub Jirák on the JetBrains Marketplace, with 195 users and a current version of 2026.3.9. The CVEQ scan produced 341 total findings, 281 of which are medium-severity IoC hits and 60 are informational. Critically, there are zero malware-signature, zero malware, zero network, zero obfuscation, zero dependency, zero secret, zero code-smell, and zero tool-poisoning findings.

Every single IoC finding follows the same pattern: XIOC is matching Java .properties internationalization filenames as domain names. Examples include it.properties read as the .it TLD, jp.properties as .jp, kr.properties as .kr, cz.properties, fi.properties, dk.properties, ir.properties, and so on. Other hits like 4z.mc, 9.ac, s.ws, dz.gt, and jsv-properties.properties are similarly artifacts of the XIOC extractor parsing filename segments as domain labels. These are known false positives from the XIOC extractor misidentifying Java ResourceBundle locale files (e.g., messages_en.properties, messages_jp.properties) as network IoCs.

There is no evidence of credential access — zero secret-severity findings and no filesystem access targeting .env, .ssh, cloud credentials, or VS Code/JetBrains secret storage. There is no postinstall payload execution, no child_process.exec, no shell commands. The extension has zero network findings, meaning no external HTTP calls were detected. There is no obfuscation — the code contains no malicious encoding, no zero-width characters, no packed payloads.

The strongest counterargument is that the extension's description field is empty, which prevents a clear determination of whether the stated purpose matches the observed behavior. However, the JetBrains Marketplace applies review scrutiny beyond what OpenVSX or VS Code Marketplace applies, and the complete absence of any behavioral IoC findings — no network traffic, no credential reads, no process spawning, no hidden files — strongly supports that this is a legitimate API contract testing tool whose Java i18n locale bundles are generating XiOC noise.

With 195 users, a named publisher, no malware signatures, and findings entirely explainable as a well-known XIOC false-positive pattern, this extension should be considered safe for installation. The risk score inflation (if any) is entirely driven by the IoC count artifact.

Key Reasons

• All 281 IoC findings are XiOC false positives matching Java .properties locale filenames as domains
• Zero malware signatures, zero network findings, zero credential access findings
• JetBrains Marketplace review provides additional vetting beyond VS Code ecosystem

False Positive Considerations

• XIOC extractor misreads Java ResourceBundle .properties filenames (it.properties, jp.properties, kr.properties) as domain names
• High IoC count (281) with severity=medium inflates risk score without representing actual threats
• No behavioral findings (network, credential, process, obfuscation) to support malicious classification

Reviewed 2026-05-30; recommended action: suppress false positive; model confidence 85%.