…it unpacks portable versins of sqlite3 and git2, which it needs to function; but these are flagged as potentially malicious “stowaways”:

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\SysWOW64\7za.exe
File created: C:\Users\user\Desktop\extract\ComparePlugin\sqlite3.dll

Source: C:\Windows\SysWOW64\7za.exe
File created: C:\Users\user\Desktop\extract\ComparePlugin\git2.dll

Source: C:\Windows\SysWOW64\7za.exe
File created: C:\Users\user\Desktop\extract\ComparePlugin.dll

Yes. It appears the sqlite3.dll and git2.dll files are the ones actually causing the Hybrid-Analysis sandbox to register the whole .zip as malicious as well. Not sure the best way to test them to verify they are good…

For example, it unpacks portable versins of sqlite3 and git2, which it needs to function; but these are flagged as potentially malicious “stowaways”:

Calls to Win32 API functions like GetModuleHandleW are basic requirements for every single Notepad++ plugin (a Win32 application par excellence). But these are all essentially untrusted, simply because they have low-level access to the system:

Possibly a rule set could be written that accounts for the typical behaviour of plugins. But I think it would end up being so permissive that basically everything would get a free pass.

There hasn’t been a compromise of the repository. I have never heard of any of the “rating” sites that never have a false positive;

Thank you for your thoughtful reply and for verifying that the plugin-repository was not compromised. You’re entirely right that false positives are not uncommon. That’s why I didn’t post until 2 separate sandbox services said they had found something. And the sheer number of JoeSandbox signatures that got “hit,” as well as the overall “appearance” of its tree diagram seem unusual, at least to the untrained eye.

most of the time, when there’s a change to anything, they start rating things as “malicious” or “dangerous” for no good reason. (The algorithms such ratings use are looking for such small signatures in the binary that it can easily false-match tons of code, compared to the one malicious code that they’re really looking for.)

While it is interesting that the brand-new Compare v2.0.2 plugin got rated as “suspicious,” what’s more interesting is that the current download of the Compare v2.0.0 plugin also got rated as malicious. This, in spite of the fact that version 2.0.0 has existed for over five years, so I would’ve expected any FP rating of it to have been resolved long ago, hence my wonderment whether the current 2.0.0 download is the same as the author’s original upload.

The incompatibility is known and fixed – you just have to use the right version of the plugin for which version of Notepad++ you are running. (Notepad++ made an internal change which required updates to most plugins to regain compatibility)

There hasn’t been a compromise of the repository. I have never heard of any of the “rating” sites that never have a false positive; most of the time, when there’s a change to anything, they start rating things as “malicious” or “dangerous” for no good reason. (The algorithms such ratings use are looking for such small signatures in the binary that it can easily false-match tons of code, compared to the one malicious code that they’re really looking for.)