Koidex by Koi Security

Analysis summary

Material Theme Icons is an IDE extension for Visual Studio Code that provides UI customization through icon themes. It received a medium risk level due to its unmaintained status and file creation activities that could potentially introduce security concerns.

Key insights:

Provides icon themes for UI customization in Visual Studio Code.
Risk level: Medium, primarily due to being unmaintained since 2017.
Engages in file creation, reading, and writing, which may pose risks if exploited for malicious purposes.
Operates within its expected scope but lacks updates, raising concerns about potential vulnerabilities.
The unmaintained status may impact development environment security by introducing outdated or unsupported components.

Findings

Deprecated Marketplace Item

Flags items that have been deprecated by their publisher, indicating they are no longer maintained or supported.”

medium

Repo Does not Exist

Flags items that have claimed to be open-source but the repository does not exist.

medium

Unverified Publisher

Flags items published by entities that haven’t gone through the publisher verification process of the marketplace. Lack of verification may indicate higher risk, as the publisher’s identity and trustworthiness are unconfirmed.

medium

All findings are available for Enterprise users

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

All API calls are available for Enterprise users

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

Box

/extension/node_modules/JSONStream/test/fixtures/all_npm.json

Unverified

Box

/extension/node_modules/JSONStream/test/fixtures/all_npm.json

Unverified

Box

/extension/node_modules/JSONStream/test/fixtures/all_npm.json

Unverified

All secrets are available for Enterprise users

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

GHSA-v6h2-p8h4-qcjw

brace-expansion Regular Expression Denial of Service vulnerability

CVSS:

All vulnerabilities are available for Enterprise users

External communication

Any identifiers we detected that may indicate external communication from the item's code

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

All external communications are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

Code Analysis of the VS Code Extension
- Functionality:
  - The code is a part of a Visual Studio Code (VS Code) extension.
  - It initializes the extension in the activate function, which is invoked when the extension is loaded.
  - It uses promises and async/await syntax to handle asynchronous operations, improving readability and maintainability.
  - The extension manages settings through a persistent_settings_1 module, which likely handles the storage and retrieval o...

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

@types/chai

Version:

Unknown

Missing

@types/mocha

Version:

Unknown

Missing

@types/mustache

Version:

Unknown

Missing

All dependencies are available for Enterprise users

Licenses & Compliance

Licenses

"Italian Version: Licenza Commerciale per \u0022Material Theme\u0022 e Derivati\n----------------------------------------------------------\n1. Licenza d\u0027Uso\n Questo accordo concede all\u0027u...