Notion Web ClipperSecurity Analysis

Dynamically creates script elements, potentially loading external malicious code.

Creates functions from strings, similar to eval(), often used to hide malicious code.

Dynamically sets a script's src attribute to load external code at runtime.

Listens for keyboard events, a common technique used by keyloggers.

Creates a function from a string (new Function()), similar to eval().

Object.defineProperty() called on window — can intercept and override built-in browser APIs.

Extension has cookie access and sends data to external servers — potential session token theft.

Decodes base64 data, commonly used to hide malicious payloads.

Uses XMLHttpRequest to make network calls.

Modifies window.location to redirect the user, potentially to phishing or malicious pages.

Line exceeds 5000 characters (entropy: 5.505250990212586)

Reads or writes to localStorage, which may contain sensitive site data.

Encodes data to base64, may be used for data exfiltration.

Sets innerHTML directly, which can lead to XSS if used with untrusted data.

object-src is not set to 'none'. Plugins like Flash can be embedded, which may allow code execution.