Detection rules
native static · filesystem

Destructive file pattern

destructive-file-pattern

Code contains destructive file-operation patterns.

Default severityMEDIUMEvidence classweak
What it means

Read the evidence before the label.

This alert records weak evidence produced by the native static analyzer. Its default severity describes potential impact, not certainty that an extension is malicious.

A final decision also considers evidence correlation, artifact identity, analysis coverage, and the active policy.

Expected evidence

Exact extension version, artifact hash, affected file or dependency, normalized rule identifier, confidence, and scanner ruleset.

Reviewer action

Confirm whether the behavior matches the extension’s declared purpose and whether execution requires explicit user intent.

Find extensions in the catalog