Is AirCoder safe?

Findings

Unverified Publisher

Flags items published by entities that haven’t gone through the publisher verification process of the marketplace. Lack of verification may indicate higher risk, as the publisher’s identity and trustworthiness are unconfirmed.

medium

Unmaintained Item

Flags items that are not maintained on the marketplace, suggesting concerns about the item's reputation and the publisher's reliability.

low

Uses Third Party AI Model

Flags items that process data using third-party AI models. AI models can be used to process data in a way that may not be transparent to the user. This can lead to organization policy violation, data leakage, privacy concerns and potential misuse of data.

low

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

The provided code is a minified and bundled JavaScript extension named AirCoder by YaleHuang. It appears to be a complex web extension or library that includes multiple modules related to HTML parsing, DOM manipulation, CSS selector parsing, and encoding/decoding of HTML entities. The code heavily relies on third-party libraries such as Cheerio for DOM handling and parsing, and includes utilities for CSS selector compilation and matching.

Key observations:

The code includes modules for parsing HTML and XML documents, handling DOM trees, and querying elements using CSS selectors.
It contains base64 encoding/decoding utilities.
The code handles HTML entity decoding and encoding.
There is no evidence of network communication, process execution, shell or PowerShell command execution.
No Windows Registry operations, file creation, user creation, or clipboard access are detected.
The code is minified but not obfuscated; variable and function names are preserved in a readable manner.
The code is intended for DOM manipulation and code generation assistance, consistent with the description "Automatically write new code, ask questions, find bugs, and more with AirCoder".

Overall, the code is a complex but standard JavaScript extension/library for code assistance and DOM manipulation without indications of malicious behavior.

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

API CALLS ARE AVAILABLE FOR ENTERPRISE USERS

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

SECRETS ARE AVAILABLE FOR ENTERPRISE USERS

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS

External communication

Any identifiers we detected that may indicate external communication from the item's code

https://api.chatanywhere.com.cn

extension/dist/extension.js

https://api.openai.com/v1

extension/dist/extension.js

https://bypass.duti.tech/api/conversation

extension/dist/extension.js

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

@types/glob

Version:

Unknown

@types/jquery

Version:

Unknown

@types/jqueryui

Version:

Unknown

All dependencies are available for Enterprise users

Licenses & Compliance

Licenses

MIT License

View License