[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Steam Community SteamRep Integration

Version 1.2.0 View in Chrome Web Store

Last scanned: about 8 hours ago

Extension Details

Rating: 4.4 ★ (17 ratings)

Users: 668

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors:

The extension has a decent rating of 4.4 stars from 17 reviews, indicating positive user experiences. However, the small user base of only 668 users suggests limited adoption and testing. The extension appears to serve a legitimate purpose by integrating SteamRep reputation data into Steam Community profiles, which is valuable for traders wanting to verify user trustworthiness.

Concerns:

The primary concern is the use of Manifest Version 2, which lacks the enhanced security protections of Manifest V3. This older framework provides fewer restrictions on extension capabilities and data access. The extension requests access to steamrep.com and runs content scripts on all Steam Community pages, which is appropriate for its stated functionality but still represents broad access to user browsing on these sites.

The limited user base and lack of detailed developer information make it difficult to assess the extension's long-term reliability and security maintenance.

Recommendations:

Consider running this extension in a separate Chrome profile if you frequently handle sensitive Steam trading activities. Monitor for updates that migrate to Manifest V3, which would improve security. Given the extension's specific use case for Steam trading, only install if you actively need SteamRep integration. Regularly review the extension's behavior and consider alternatives with larger user bases or more recent updates if available.

Findings

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Raw Manifest

{
  "name": "Steam Community SteamRep Integration",
  "icons": {
    "16": "16.png",
    "48": "48.png",
    "128": "128.png"
  },
  "version": "1.2.0",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Displays SteamRep status on Steam Community profile pages",
  "permissions": [
    "http://steamrep.com/"
  ],
  "homepage_url": "http://www.steamrep.com",
  "content_scripts": [
    {
      "js": [
        "steamcommunity.js"
      ],
      "matches": [
        "http://steamcommunity.com/*"
      ]
    }
  ],
  "manifest_version": 2
}

by ✦ Astarte

Steam Community SteamRep Integration

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (7 total):

Raw Manifest

Detections

Manifest Findings

https://clients2.google.com/service/update2/crx	http://www.steamrep.com
http://steamrep.com/	http://steamcommunity.com/
http://jsfromhell.com/classes/bignumber	http://steamrep.com/id2rep.php?steamID32=STEAM_0:
http://steamrep.com/profiles/