[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Octoshop: Price compare, cashback, alerts

Version 104.36.3 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Rating: 4.9 ★ (428 ratings)

Users: 30,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 5 total findings, including 3 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
unlimitedStorage
background
webRequest
declarativeNetRequest
alarms
offscreen
cookies

Optional Permissions:

notifications

Host Permissions:

http://*/*
https://*/*

Embedded URLs (82 total):

https://use.typekit.net/lmt0myn.css	https://clients2.google.com/service/update2/crx
https://ibotta.com/	https://www.robotstxt.org/robotstxt.html
https://api.ibops.net/bex-api	https://api.staging.ibops.net/bex-api
https://github.com/crypto-browserify/crypto-browserify	https://github.com/uuidjs/uuid#getrandomvalues-not-supported
https://tracking.ibotta-classic.ipn-ops.net/v1/track_message	https://tracking.ibotta-classic.staging.ipn-ops.net/v1/track_message
https://ibotta.com/login	https://ibotta.com/home
https://ibotta.com/bex-token	https://ibotta.com/account/settings
https://ibotta.com	https://api.octoshop.org
https://www.instok.org	https://bex-iframe.s3.amazonaws.com
https://chrome.google.com/webstore/detail/ibotta-price-compare-cash/mfaedmjlefifhnhpgipjjiiekchaimpk/reviews	https://api.ibops.net/bex-api/retailer-config
https://aws.instok.org/dummyStore-a42fadabym	https://aws.instok.org/dummyStore-a42fadabym?cart=true
https://aws.instok.org/dummyStore-a42fadabym?checkOut=true	https://www.instok.org/api/dummyItem-a42fadabym
https://www.instok.org/api/loc	https://ibotta.com/customer_id
https://api.ibops.net/bex-api/	https://media-exp1.licdn.com/dms/image/C4E0BAQEi6lAKiD-gFQ/company-logo_200_200/0/1590261563808?e=1666224000&v=beta&t=2GQiSdc_oZicQzS10XgyLG5EeFSJjhopBZmCJQOsfJQ
https://app.configcat.com/sdkkey	https://configcat.com/support/
https://configcat.com/docs/advanced/user-object/	https://configcat.com/docs/advanced/data-governance/
https://cdn-eu.configcat.com	https://cdn-global.configcat.com
https://configcat.com/docs/sdk-reference/js/#setting-type-mapping	https://ibotta.com/uninstall-feedback?deviceId=
https://api.octoshop.org/api/stores/addProducts	https://api.octoshop.org/api/allMetasNew
https://api.octoshop.org/api/stores/	https://api.octoshop.org/api/productHistory
https://api.octoshop.org/api/stores/storeMeta	https://api.octoshop.org/api/stores/taggedStores
https://api.octoshop.org/api/stores/match	https://api.octoshop.org/api/stores/storeList
https://api.octoshop.org/api/stores/searchPage/	https://api.octoshop.org/api/products/match
https://api.ibops.net/bex-api/offer-match	https://api.octoshop.org/api/stores/track/
https://github.com/date-fns/date-fns/blob/master/docs/unicodeTokens.md	https://api.octoshop.org/api/extn/mv3Report
https://ibotta.com/upgrade-extension	https://ibotta.com/browser-extension?installed=true
http://fb.me/use-check-prop-types	https://reactjs.org/docs/error-decoder.html?invariant=
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
http://www.w3.org/1999/xhtml	http://www.w3.org/1998/Math/MathML
http://www.w3.org/2000/svg	https://www.ibotta.com/
https://www.walmart.com/ip/AirPods-3rd-Generation/510546422?athbdg=L1300	https://www.instok.org/img/favicons/
https://github.com/zloirock/core-js/blob/v3.25.5/LICENSE	https://github.com/zloirock/core-js
https://www.google.com/s2/favicons?sz=64&domain_url=	https://help.ibotta.com/
https://help.ibotta.com/hc/en-us/requests/new	https://legal.ibotta.com/policies?name=ibotta-privacy-policy
https://legal.ibotta.com/policies?name=ibotta-terms-of-use	http://www.ibotta.com/account
https://www.walmart.com/search?q=ibotta+secret+sauce	https://www.walmart.com/search?q=ibotta%20secret%20sauce
https://www.target.com/s?searchTerm=ibotta+secret+sauce	https://www.ae.com/us/en/s/ibotta+secret+sauce
https://www.chewy.com/s?query=ibotta%20secret%20sauce&nav-submit-button=	https://www.amazon.com/?query=ibotta%20secret%20sauce
https://bex-iframe.s3.amazonaws.com/index.html	http://www.w3.org/2000/xmlns/
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd	http://schema.org/Product

Page 1 of 2

Raw Manifest

{
  "name": "Octoshop: Price compare, cashback, alerts",
  "icons": {
    "16": "icons/octoshop_icon_production_16.png",
    "32": "icons/octoshop_icon_production_32.png",
    "48": "icons/octoshop_icon_production_48.png",
    "128": "icons/octoshop_icon_production_128.png"
  },
  "action": {
    "default_popup": "browserAction.html"
  },
  "version": "104.36.3",
  "background": {
    "service_worker": "static/js/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Get the best price every time! Earn cash back at thousands of retailers, compare prices, and set price drop alerts.",
  "permissions": [
    "storage",
    "unlimitedStorage",
    "background",
    "webRequest",
    "declarativeNetRequest",
    "alarms",
    "offscreen",
    "cookies"
  ],
  "content_scripts": [
    {
      "js": [
        "/static/js/content.js"
      ],
      "css": [
        "/static/css/content.css"
      ],
      "matches": [
        "http://*/*",
        "https://*/*"
      ]
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "notifications"
  ],
  "externally_connectable": {
    "ids": [
      "mfaedmjlefifhnhpgipjjiiekchaimpk",
      "eakakilajiadeadpakfhgahplpphgiko",
      "daoahnjjdjmnkppejpdedleddnnccdmh",
      "odcdkbcfkbfldbcadjnpiphmacnkckll",
      "ahajkaoongodcmoohkcceoklokapadfh",
      "lhnbfmicemfhkonkkejfpcjdpkphkppm",
      "dpokhdgldbkphnijmamknognepahmkhi"
    ],
    "matches": [
      "https://ibotta.com/*"
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "static/media/*",
        "*"
      ]
    }
  ]
}

by ✦ Astarte

Octoshop: Price compare, cashback, alerts

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Embedded URLs (82 total):

Raw Manifest

Detections

Manifest Findings