This extension shows concerning patterns that may indicate risky behavior. Proceed with caution.
Compromised in Cyberhaven supply chain attack
Extension was among 35+ extensions compromised in the December 2024 supply chain attack campaign that injected data-stealing code.
This extension shows significant risk signals. Review the findings below carefully before installing or continuing to use it.
Based on 7 permissions including high-risk ones, 32 code findings, 3 dangerous combinations.
Extension uses tab tracking APIs (onUpdated/query) and communicates with external servers — potential browsing surveillance.
Extension intercepts network traffic and sends data externally — potential man-in-the-middle behavior.
Extension has access to all sites and captures keyboard input — behavior consistent with a keylogger.
This extension does not define a Content Security Policy. A CSP helps prevent XSS and code injection attacks.
JavaScript files are accessible to ALL websites. Any page can load and interact with these scripts, enabling web→extension attacks.
Web-accessible resources use <all_urls> or wildcard patterns, exposing resources to every website.
Extension accepts messages from 1 external pattern(s). Verify these are trusted origins.
Content script matches <all_urls>, executing on every website the user visits.
7 indicators of compromise found