[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Octopus - All-in-One LinkedIn Automation

Version 3.7.19 View in Chrome Web Store

Last scanned: about 1 hour ago

Extension Details

Developer: http://octopuscrm.io/

Rating: 4.3 ★ (158 ratings)

Users: 60,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 5 total findings, including 3 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: history

This extension has the history permission. Can access your browsing history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: https://linkedin.com/*, https://*.linkedin.com/*, https://www.googleapis.com/*, https://apis.google.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

Security Analysis Details

Required Permissions:

tabs
notifications
history
scripting
offscreen

Host Permissions:

https://linkedin.com/*
https://*.linkedin.com/*
https://api.octopuscrm.io/*
https://hooks.zapier.com/*
https://octopuscrm-io.firebaseapp.com/*
https://*.make.com/*
https://cdnjs.cloudflare.com/ajax/libs/raphael/*
https://*.firebaseio.com/*
https://www.googleapis.com/*
https://www.gstatic.com/*
https://apis.google.com/*
https://us-central1-test-proj-7d39d.cloudfunctions.net/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'none'

Embedded URLs (110 total):

http://www.w3.org/2000/svg	http://www.apache.org/licenses/
http://www.apache.org/licenses/LICENSE-2.0	http://robertpenner.com/easing/
http://eligrey.com	https://www.highcharts.com/license
https://openjsf.org/	http://underscorejs.org/
https://github.com/lodash/lodash	http://creativecommons.org/publicdomain/zero/1.0/
http://angular.io/license	https://github.com/facebook/regenerator/blob/main/LICENSE
http://w3.org/TR/SVG11/feature#Extensibility	http://www.w3.org/1999/xlink
https://www.highcharts.com?credits	https://staging-identitytoolkit.sandbox.googleapis.com/identitytoolkit/v3/relyingparty/
https://staging-securetoken.sandbox.googleapis.com/v1/token	https://staging-identitytoolkit.sandbox.googleapis.com/v2/
https://www.googleapis.com/identitytoolkit/v3/relyingparty/	https://securetoken.googleapis.com/v1/token
https://identitytoolkit.googleapis.com/v2/	https://staging-www.sandbox.googleapis.com/identitytoolkit/v3/relyingparty/
https://www-googleapis-test.sandbox.google.com/identitytoolkit/v3/relyingparty/	https://test-securetoken.sandbox.googleapis.com/v1/token
https://test-identitytoolkit.sandbox.googleapis.com/v2/	https://apis.google.com/js/client.js?onload=%
https://apis.google.com/js/api.js?onload=%	https://www.google.com/recaptcha/api.js?onload=%
https://npms.io/search?q=ponyfill.	https://console.firebase.google.com/.
http://momentjs.com/guides/#/warnings/define-locale/	http://momentjs.com/guides/#/warnings/js-date/
http://momentjs.com/guides/#/warnings/min-max/	http://momentjs.com/guides/#/warnings/add-inverted-param/
http://momentjs.com/guides/#/warnings/zone/	http://momentjs.com/guides/#/warnings/dst-shifted/
https://webpack.js.org/configuration/resolve/#resolvemainfields	https://github.com/rollup/rollup-plugin-node-resolve
https://g.co/ng/security#xss	http://www.w3.org/1998/MathML/
http://www.w3.org/1999/xhtml	http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/	https://octopuscrm-io.firebaseio.com
https://api.octopuscrm.io/signed	https://api.octopuscrm.io
https://app.dripify.com/api	https://linkedin.com
https://linkedin.com/in/	https://www.linkedin.com/in/johndoe/
https://www.linkedin.com/in/ADoABA8BYqEBCGLg_vT_ca6mMEqkpp9nVffJ3hc	https://www.linkedin.com/profile/view?id=johndoe
https://www.linkedin.com/sales/profile/251749025	https://www.linkedin.com/sales/people/ACwAAA8BYqEBlKc364xhzvygIeuJJ3rATiwe2NE
https://www.linkedin.com/recruiter/profile/245312312	https://youtu.be/cYFhgi2sRTY
https://www.youtube.com/embed/iBOEfXPzUUg	https://octopuscrm.io/tutorial/
https://octopuscrm.io/	https://api.octopuscrm.io/onuninstall?uid=
https://www.linkedin.com/voyager/api/relationships/connections?sortType=RECENTLY_ADDED	https://www.linkedin.com/voyager/api/identity/miniprofiles/
https://www.linkedin.com/in/williamhgates/	https://www.gatesnotes.com/
https://www.linkedin.com	https://octopuscrm.io/tutorial
https://www.youtube.com/embed/lFt3SqcBsbI	https://dripify.io/?utm_source=inocto&utm_medium=activesub&utm_campaign=banner
https://dripify.io/?utm_source=inocto&utm_medium=otherusers&utm_campaign=banner	https://octopuscrm.onfastspring.com/account
https://octopuscrm.io/email-payment?secureKey=	https://octopuscrm.io/payment?product=
https://octopuscrm.io/subscription	https://clients2.google.com/service/update2/crx
https://linkedin.com/	https://api.octopuscrm.io/
https://hooks.zapier.com/	https://octopuscrm-io.firebaseapp.com/
https://cdnjs.cloudflare.com/ajax/libs/raphael/	https://www.googleapis.com/

Page 1 of 2

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiXWkf7nGTpY/AoD81+cQPYGmb+c+HJFLj3lUOYE/EuA+BaQX8m/CejfgPZ+Gr/7TiE20XCpItc3KjbJc4JcAf+z7BylL26GgYyWEys0yOlUF0HGGFrCQg7XnW9rtL+hA708lgtGADgo4FyCyhAjeuP2P+uHmiXs4MAUjMdeJHm+Av81H7pGo9HnkRT3gq6kI9Niz6FkbjIzzrO2ND88X2Yol6I/sNLJMYh9aLBpbbIt0Q2lANbotA5DvvFNQhKKv/5lmB5Hlcpu3DYJNmYtGauk+AOGoipzJexF67H5wuS6W+7aCLCrhKmM6NmJ3Lvcj2X0bRPGqNHIhktKpKGQcpQIDAQAB",
  "name": "Octopus - All-in-One LinkedIn Automation",
  "icons": {
    "16": "assets/logo.png",
    "32": "assets/logo.png",
    "48": "assets/logo.png"
  },
  "action": {
    "default_icon": "assets/logo.png",
    "default_popup": "index-test.html#/popup",
    "default_title": "Octopus"
  },
  "version": "3.7.19",
  "background": {
    "type": "module",
    "service_worker": "background.js"
  },
  "short_name": "The sales prospecting, autopilot, linked helper, and LinkedIn lead generation tool: auto connect, send automated messages and skrapp!",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Automation Software for LinkedIn lead generation, social selling and LinkedIn auto connect tool",
  "permissions": [
    "tabs",
    "notifications",
    "history",
    "scripting",
    "offscreen"
  ],
  "content_scripts": [
    {
      "js": [
        "assets/content.js",
        "assets/action-content.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://www.linkedin.com/*"
      ]
    }
  ],
  "host_permissions": [
    "https://linkedin.com/*",
    "https://*.linkedin.com/*",
    "https://api.octopuscrm.io/*",
    "https://hooks.zapier.com/*",
    "https://octopuscrm-io.firebaseapp.com/*",
    "https://*.make.com/*",
    "https://cdnjs.cloudflare.com/ajax/libs/raphael/*",
    "https://*.firebaseio.com/*",
    "https://www.googleapis.com/*",
    "https://www.gstatic.com/*",
    "https://apis.google.com/*",
    "https://us-central1-test-proj-7d39d.cloudfunctions.net/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'none'"
  }
}

by ✦ Astarte

Octopus - All-in-One LinkedIn Automation

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (110 total):

Raw Manifest

Detections

Manifest Findings