[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Foxtrick (Beta)

Version 0.17.9.2857 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: foxtrick.org

Rating: 5.0 ★ (9 ratings)

Users: 9,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a perfect 5.0 rating but with only 9 reviews, making the sample size too small for reliable assessment. With 9,000 users, it has moderate adoption but lacks transparency regarding the developer's identity and company reputation. The foxtrick.org domain suggests it's related to the Hattrick online football management game, which provides some context for its purpose.

Concerns: The extension requests several high-risk permissions that could be concerning. The cookies permission allows access to sensitive authentication data across multiple Hattrick domains, while clipboardWrite could potentially inject malicious content. The broad host permissions across numerous Hattrick-related domains (*://*.hattrick.org/*, *://*.hattrick.ws/*, etc.) create an extensive attack surface. The use of Manifest V2 provides fewer security protections compared to V3. The combination of cookie access and clipboard modification capabilities presents privacy and security risks if the extension were compromised.

Recommendations: Given the high-risk permissions, consider running this extension in a separate Chrome profile dedicated to Hattrick gaming activities. Verify the extension's legitimacy by checking if it's officially endorsed by Hattrick or the gaming community. Monitor your clipboard content after using the extension and be cautious about sensitive information. Consider whether all the requested permissions are necessary for the extension's stated functionality, and look for alternative extensions with more limited permission requests if available.

Findings

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

storage
cookies
contextMenus
notifications
clipboardWrite
*://chpp.hattrick.org/*
*://*.foxtrick.org/*
https://www.fantamondi.it/*

Optional Permissions:

https://*.hattrick-youthclub.org/*
http://no9-online.de/*
http://www.latehome.de/*
https://vimeo.com/api/*
https://www.youtube.com/*
https://www.dailymotion.com/services/*
https://secure.flickr.com/services/oembed/*
http://backend.deviantart.com/*
https://soundcloud.com/*
https://imageshack.us/*
http://api.openweathermap.org/*

Embedded URLs (338 total):

Page 1 of 5

Raw Manifest

{
  "name": "Foxtrick (Beta)",
  "icons": {
    "16": "skin/icon-16.png",
    "48": "skin/icon-48.png",
    "128": "skin/icon-128.png"
  },
  "version": "0.17.9.2857",
  "background": {
    "page": "content/background.html"
  },
  "options_ui": {
    "page": "content/preferences.html",
    "open_in_tab": true,
    "chrome_style": false,
    "browser_style": false
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "A set of presentation enhancements for hattrick.org",
  "page_action": {
    "default_icon": "skin/icon-24.png",
    "default_popup": "content/popup.html",
    "default_title": "Foxtrick enabled"
  },
  "permissions": [
    "storage",
    "cookies",
    "contextMenus",
    "notifications",
    "clipboardWrite",
    "*://chpp.hattrick.org/*",
    "*://*.foxtrick.org/*",
    "https://www.fantamondi.it/*"
  ],
  "homepage_url": "https://www.foxtrick.org/",
  "content_scripts": [
    {
      "js": [
        "content/env.js",
        "content/prefs-util.js",
        "content/l10n.js",
        "content/xml-load.js",
        "content/pages.js",
        "content/lib/oauth.js",
        "content/lib/sha1.js",
        "content/lib/PluralForm.js",
        "content/lib/psico.js",
        "content/lib/gauge.js",
        "content/lib/exceptionless.universal.js",
        "content/lib/integration.js",
        "content/util/api.js",
        "content/util/array.js",
        "content/util/async.js",
        "content/util/color.js",
        "content/util/cookies.js",
        "content/util/copy-button.js",
        "content/util/css.js",
        "content/util/currency.js",
        "content/util/dom.js",
        "content/util/ht-ml.js",
        "content/util/id.js",
        "content/util/inject.js",
        "content/util/layout.js",
        "content/util/links-box.js",
        "content/util/load.js",
        "content/util/local-store.js",
        "content/util/log.js",
        "content/util/match-event.js",
        "content/util/match-view.js",
        "content/util/math.js",
        "content/util/misc.js",
        "content/util/module.js",
        "content/util/note.js",
        "content/util/notify.js",
        "content/util/permissions.js",
        "content/util/sanitize.js",
        "content/util/session-store.js",
        "content/util/string.js",
        "content/util/tabs.js",
        "content/util/time.js",
        "content/pages/all.js",
        "content/pages/match.js",
        "content/pages/matches.js",
        "content/pages/player.js",
        "content/pages/players.js",
        "content/pages/series.js",
        "content/pages/transfer-search-results.js",
        "content/pages/youth-player.js",
        "content/api/hy/common.js",
        "content/api/hy/matches-report.js",
        "content/api/hy/matches-training.js",
        "content/api/hy/players-youth-reject-call.js",
        "content/api/hy/players-youth-skills.js",
        "content/api/hy/user-id.js",
        "content/api/mercattrick/common.js",
        "content/api/mercattrick/players-stats.js",
        "content/add-class.js",
        "content/core.js",
        "content/fix-links.js",
        "content/forum-stage.js",
        "content/read-ht-prefs.js",
        "content/redirections.js",
        "content/ui.js",
        "content/access/aria-landmarks.js",
        "content/alert/live-alert.js",
        "content/alert/new-mail.js",
        "content/alert/ticker-alert.js",
        "content/alert/ticker-coloring.js",
        "content/forum/auto-post-specs.js",
        "content/forum/embed-media.js",
        "content/forum/forum-change-posts-modules.js",
        "content/forum/forum-change-posts.js",
        "content/forum/forum-direct-page-links.js",
        "content/forum/forum-last-post.js",
        "content/forum/forum-leave-button.js",
        "content/forum/forum-mod-popup.js",
        "content/forum/forum-next-and-previous.js",
        "content/forum/forum-presentation.js",
        "content/forum/forum-preview.js",
        "content/forum/forum-strip-hattrick-links.js",
        "content/forum/forum-templates.js",
        "content/forum/forum-thread-auto-ignore.js",
        "content/forum/forum-youth-icons.js",
        "content/forum/go-to-post-box.js",
        "content/forum/hide-signatures.js",
        "content/forum/ht-thread-marker.js",
        "content/forum/mark-all-as-read.js",
        "content/forum/show-forum-pref-button.js",
        "content/forum/staff-marker.js",
        "content/information-aggregation/cross-table.js",
        "content/information-aggregation/current-transfers.js",
        "content/information-aggregation/dashboard-calendar.js",
        "content/information-aggregation/election-table.js",
        "content/information-aggregation/extended-player-details.js",
        "content/information-aggregation/extra-player-info.js",
        "content/information-aggregation/flag-collection-to-map.js",
        "content/information-aggregation/history-stats.js",
        "content/information-aggregation/htms-points.js",
        "content/information-aggregation/last-login.js",
        "content/information-aggregation/match-weather.js",
        "content/information-aggregation/mercattrick-stats.js",
        "content/information-aggregation/my-monitor.js",
        "content/information-aggregation/nt-peek.js",
        "content/information-aggregation/player-birthday.js",
        "content/information-aggregation/player-positions-evaluations.js",
        "content/information-aggregation/player-stats-experience.js",
        "content/information-aggregation/psico-tsi.js",
        "content/information-aggregation/season-stats.js",
        "content/information-aggregation/series-flags.js",
        "content/information-aggregation/series-transfers.js",
        "content/information-aggregation/show-friendly-booked.js",
        "content/information-aggregation/show-lineup-set.js",
        "content/information-aggregation/skill-table.js",
        "content/information-aggregation/specialty-info.js",
        "content/information-aggregation/supporterstats-enhancements.js",
        "content/information-aggregation/table-of-statistical-truth.js",
        "content/information-aggregation/team-stats.js",
        "content/information-aggregation/transfer-compare-players.js",
        "content/information-aggregation/transfer-deadline.js",
        "content/information-aggregation/u21-lastmatch.js",
        "content/information-aggregation/youth-promotes.js",
        "content/information-aggregation/youth-series-estimation.js",
        "content/information-aggregation/youth-skills.js",
        "content/links/links-achievements.js",
        "content/links/links-alliances.js",
        "content/links/links-arena.js",
        "content/links/links-challenges.js",
        "content/links/links-club-transfers.js",
        "content/links/links-coach.js",
        "content/links/links-country.js",
        "content/links/links-economy.js",
        "content/links/links-fans.js",
        "content/links/links-league.js",
        "content/links/links-manager.js",
        "content/links/links-match.js",
        "content/links/links-national.js",
        "content/links/links-player-detail.js",
        "content/links/links-players.js",
        "content/links/links-team.js",
        "content/links/links-tracker.js",
        "content/links/links-training.js",
        "content/links/links-world.js",
        "content/links/links-youth.js",
        "content/links/links.js",
        "content/matches/att-vs-def.js",
        "content/matches/copy-ratings.js",
        "content/matches/htms-prediction.js",
        "content/matches/live-match-report-format.js",
        "content/matches/match-income.js",
        "content/matches/match-lineup-fixes.js",
        "content/matches/match-lineup-tweaks.js",
        "content/matches/match-order-new.js",
        "content/matches/match-order.js",
        "content/matches/match-player-colouring.js",
        "content/matches/match-ratings-tweaks.js",
        "content/matches/match-report-format.js",
        "content/matches/match-simulator.js",
        "content/matches/ratings.js",
        "content/presentation/bookmark-adjust.js",
        "content/presentation/country-list.js",
        "content/presentation/currency-converter.js",
        "content/presentation/custom-medals.js",
        "content/presentation/fans.js",
        "content/presentation/fix-css-problems.js",
        "content/presentation/friendly-interface.js",
        "content/presentation/friendly-pool.js",
        "content/presentation/header-toggle.js",
        "content/presentation/highlight-cup-wins.js",
        "content/presentation/highlight-ownerless.js",
        "content/presentation/ht-date-format.js",
        "content/presentation/large-flags.js",
        "content/presentation/league-news-filter.js",
        "content/presentation/local-time.js",
        "content/presentation/loyalty-display.js",
        "content/presentation/move-manager-online.js",
        "content/presentation/move-player-select-box.js",
        "content/presentation/move-player-statement.js",
        "content/presentation/old-style-face.js",
        "content/presentation/original-face.js",
        "content/presentation/personality-images.js",
        "content/presentation/ratings-display.js",
        "content/presentation/safe-for-work.js",
        "content/presentation/simple-presentation.js",
        "content/presentation/skill-coloring.js",
        "content/presentation/skill-translation.js",
        "content/presentation/skin-plugin.js",
        "content/presentation/supporters-list.js",
        "content/presentation/team-select-box.js",
        "content/presentation/youth-skill-hide-unknown.js",
        "content/shortcuts-and-tweaks/add-promotion-reminder.js",
        "content/shortcuts-and-tweaks/confirm-actions.js",
        "content/shortcuts-and-tweaks/context-menu-copy.js",
        "content/shortcuts-and-tweaks/copy-bb-ad.js",
        "content/shortcuts-and-tweaks/copy-match-id.js",
        "content/shortcuts-and-tweaks/copy-player-ad.js",
        "content/shortcuts-and-tweaks/copy-youth.js",
        "content/shortcuts-and-tweaks/extra-shortcuts.js",
        "content/shortcuts-and-tweaks/filter.js",
        "content/shortcuts-and-tweaks/lineup-shortcut.js",
        "content/shortcuts-and-tweaks/manager-buttons.js",
        "content/shortcuts-and-tweaks/player-filters.js",
        "content/shortcuts-and-tweaks/rapid-id.js",
        "content/shortcuts-and-tweaks/relive-links.js",
        "content/shortcuts-and-tweaks/senior-team-shortcuts.js",
        "content/shortcuts-and-tweaks/supportership-expiration-date.js",
        "content/shortcuts-and-tweaks/table-sort.js",
        "content/shortcuts-and-tweaks/team-popup-links.js",
        "content/shortcuts-and-tweaks/transfer-history-filters.js",
        "content/shortcuts-and-tweaks/transfer-search-filters.js",
        "content/shortcuts-and-tweaks/transfer-search-result-filters.js",
        "content/entry.js",
        "content/loader-chrome.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.hattrick.org/*",
        "*://*.hattrick.ws/*",
        "*://*.hattrick.bz/*",
        "*://*.hat-trick.net/*",
        "*://*.hattrick.uol.com.br/*",
        "*://*.hattrick.interia.pl/*",
        "*://*.hattrick.name/*",
        "*://*.hattrick.fm/*"
      ]
    }
  ],
  "manifest_version": 2,
  "optional_permissions": [
    "https://*.hattrick-youthclub.org/*",
    "http://no9-online.de/*",
    "http://www.latehome.de/*",
    "https://vimeo.com/api/*",
    "https://www.youtube.com/*",
    "https://www.dailymotion.com/services/*",
    "https://secure.flickr.com/services/oembed/*",
    "http://backend.deviantart.com/*",
    "https://soundcloud.com/*",
    "https://imageshack.us/*",
    "http://api.openweathermap.org/*"
  ],
  "minimum_chrome_version": "73",
  "web_accessible_resources": [
    "content/resources/css/*.css",
    "content/resources/img/*.gif",
    "content/resources/img/*.png",
    "content/resources/notes/*.png",
    "content/resources/personality/*.jpg",
    "content/resources/skillcolors/*.css",
    "content/resources/sounds/*.mp3",
    "content/resources/sounds/*.ogg",
    "content/resources/sounds/*.wav",
    "content/preferences.html"
  ]
}

by ✦ Astarte

Foxtrick (Beta)

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Embedded URLs (338 total):

Raw Manifest

Detections

Manifest Findings

http://fsf.org/	http://www.gnu.org/licenses/
http://www.gnu.org/philosophy/why-not-lgpl.html	https://github.com/minj/foxtrick/
https://github.com/minj/foxtrick/issues	https://github.com/minj/foxtrick.git
http://git-scm.com/book/en/v2	https://help.github.com/
https://github.com/minj/foxtrick	https://crowdin.com/project/foxtrick
https://guides.github.com/introduction/flow/index.html	https://windows.github.com/
https://www.hattrick.org/goto.ashx?path=/Forum/Read.aspx?t=16281487%26n=1%26v=4	https://www.hattrick.org/goto.ashx?path=/Club/?TeamID=9999999
http://www.ht-ys.org/read_fixtures	http://www.ht-ys.org
http://radio-no9.de/_no9/no9status.php	http://www.latehome.de/foxtrick/status.php
https://stage.hattrick.org	https://www.hattrick.org
http://www.foxtrick.org/screenshots/index.php/information-aggregation/68-crosstable	http://www.foxtrick.org/screenshots/index.php/information-aggregation/71-electiontable
http://www.foxtrick.org/screenshots/index.php/information-aggregation/73-extendedplayerdetails	http://www.foxtrick.org/screenshots/index.php/information-aggregation/74-extendedplayerdetails
http://www.foxtrick.org/screenshots/index.php/information-aggregation/72-extendedplayerdetails	http://www.foxtrick.org/screenshots/index.php/information-aggregation/190-ftteamstats
http://www.foxtrick.org/screenshots/index.php/information-aggregation/211-ExtraPlayerInfo.Flags	http://www.foxtrick.org/screenshots/index.php/information-aggregation/80-historystats
http://www.foxtrick.org/screenshots/index.php/information-aggregation/81-lastlogin	http://www.foxtrick.org/screenshots/index.php/information-aggregation/82-mediantransferprice
http://www.foxtrick.org/screenshots/index.php/information-aggregation/79-playerbirthday	http://www.foxtrick.org/screenshots/index.php/information-aggregation/91-transferlistdeadline
http://www.foxtrick.org/screenshots/index.php/information-aggregation/94-youthpromotes	http://www.foxtrick.org/screenshots/index.php/information-aggregation/202-adultskilltable
http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/48-ManagerButtons	http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/62-contextmenuecopyid
http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/63-copymatchid	http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/64-copyplayeradtoclipboard
http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/75-extendedplayerdetails	http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/77-foxtricklineupshortcut
http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/78-foxtricklineupshortcut	http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/213-rapidid
http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/83-seasonstats	http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/84-seniorteamshortcuts
http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/86-shortcutsstatistics	http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/85-shortcutsstatistics
http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/87-teamselectbox	http://www.foxtrick.org/screenshots/index.php/shortcuts-and-tweaks/92-transferlistsearchfilters
http://www.foxtrick.org/screenshots/index.php/presentation/54-currency-converter	http://www.foxtrick.org/screenshots/index.php/presentation/49-backgroundfixed
http://www.foxtrick.org/screenshots/index.php/presentation/97-colouredyouthfaces	http://www.foxtrick.org/screenshots/index.php/presentation/98-countrylisthideflagontop
http://www.foxtrick.org/screenshots/index.php/presentation/99-countrylistmanagerpage	http://www.foxtrick.org/screenshots/index.php/presentation/100-countrylistselectboxes
http://www.foxtrick.org/screenshots/index.php/presentation/101-countrylistteampage	http://www.foxtrick.org/screenshots/index.php/presentation/102-custommedals
http://www.foxtrick.org/screenshots/index.php/forum/103-forumspoilerreveal	http://www.foxtrick.org/screenshots/index.php/presentation/104-simplepresentationguestbook
http://www.foxtrick.org/screenshots/index.php/forum/105-forumpresentationhideflagsinforumheader	http://www.foxtrick.org/screenshots/index.php/forum/106-forumpresentationhideleagueinforumheader
http://www.foxtrick.org/screenshots/index.php/presentation/107-fixcssproblemshighlightstaffonallpages	http://www.foxtrick.org/screenshots/index.php/presentation/108-simplepresentationleaguetable
http://www.foxtrick.org/screenshots/index.php/presentation/109-simplepresentationlivehighlightred	http://www.foxtrick.org/screenshots/index.php/presentation/110-simplepresentationnologo
http://www.foxtrick.org/screenshots/index.php/mainoptionsmenue/59-skinplugin	http://www.foxtrick.org/screenshots/index.php/presentation/214-fixcssproblemshideforumnotificationbox
http://www.foxtrick.org/screenshots/index.php/presentation/191-foxtricksmallerpagesreducebid	http://www.foxtrick.org/screenshots/index.php/presentation/115-hidefaceinjuryimages
http://www.foxtrick.org/screenshots/index.php/presentation/116-hidefacesuspendedimages	http://www.foxtrick.org/screenshots/index.php/presentation/117-hidefacetransferimages
http://www.foxtrick.org/screenshots/index.php/presentation/118-highlightbotteams	http://www.foxtrick.org/screenshots/index.php/presentation/119-highlightcupwins
http://www.foxtrick.org/screenshots/index.php/presentation/123-htdateformatfirstdayofweekoffset	http://www.foxtrick.org/screenshots/index.php/presentation/124-htdateformatlocalsaison
http://www.foxtrick.org/screenshots/index.php/presentation/122-htdateformat	http://www.foxtrick.org/screenshots/index.php/presentation/125-largeflags
http://www.foxtrick.org/screenshots/index.php/presentation/126-leaguenewsfilter	http://www.foxtrick.org/screenshots/index.php/presentation/127-matchtables
http://www.foxtrick.org/screenshots/index.php/presentation/128-matchtablesremovetime	http://www.foxtrick.org/screenshots/index.php/presentation/129-movemanageronline