TwList - X/Twitter List Scraper

Version 1.5.0 View in Chrome Web Store

Last scanned: 9 months ago | force re-scan

Extension Details

Rating: 2.0 ★ (1 rating)

Users: 264

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

The extension has very limited adoption with only 264 users and a concerning 2.0-star rating from just one review, indicating poor user satisfaction. The lack of developer information and company details raises transparency concerns. The extension's purpose as a Twitter/X list scraper is legitimate but niche.

Concerns:

The webRequest permission is particularly concerning as it allows the extension to intercept and potentially modify all network requests on Twitter/X, going beyond what's typically needed for simple list scraping. The broad host permissions for both twitter.com and x.com domains, combined with unlimited storage capability, create a powerful surveillance toolkit. The storage permissions could be used to collect and retain extensive user data indefinitely. The low user rating suggests potential functionality or security issues that existing users have encountered.

Recommendations:

Given the high-risk permissions and poor user feedback, consider running this extension in a separate Chrome profile to isolate it from your main browsing data. Before installation, verify that simpler alternatives exist for Twitter list management. If you must use this extension, regularly review what data it has stored using Chrome's extension management tools. Monitor your Twitter account for any unusual activity after installation. Consider whether the functionality truly requires such extensive permissions, as many list management tasks can be accomplished through Twitter's native interface or less invasive tools.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: *://*.twitter.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
webRequest
unlimitedStorage

Host Permissions:

*://*.twitter.com/*
*://*.x.com/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (98 total):

https://clients2.google.com/service/update2/crx	https://twlistwexport.extensionsfox.com/
https://vuejs.org/error-reference/#runtime-	http://www.w3.org/2000/svg
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xlink
http://momentjs.com/guides/#/warnings/define-locale/	http://momentjs.com/guides/#/warnings/js-date/
http://momentjs.com/guides/#/warnings/min-max/	http://momentjs.com/guides/#/warnings/add-inverted-param/
http://momentjs.com/guides/#/warnings/zone/	http://momentjs.com/guides/#/warnings/dst-shifted/
https://api.extensionsfox.com/v1	https://extensionsfox.com/checkout
https://twlistexport.extensionsfox.com/	https://twitter.com/
https://x.com/	https://x.com/i/lists/
https://x.com/i/lists/1321186052036456449/members	https://chromewebstore.google.com/detail/
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE
https://www.x.com/	http://sheetjs.com
http://schemas.openxmlformats.org/package/2006/metadata/core-properties	http://schemas.openxmlformats.org/officeDocument/2006/custom-properties
http://schemas.openxmlformats.org/officeDocument/2006/extended-properties	http://schemas.openxmlformats.org/package/2006/content-types
http://schemas.openxmlformats.org/package/2006/relationships	http://schemas.microsoft.com/office/spreadsheetml/2018/threadedcomments
http://purl.org/dc/elements/1.1/	http://purl.org/dc/terms/
http://purl.org/dc/dcmitype/	http://schemas.microsoft.com/office/mac/excel/2008/main
http://schemas.openxmlformats.org/officeDocument/2006/relationships	http://schemas.openxmlformats.org/package/2006/sheetjs/core-properties
http://schemas.openxmlformats.org/officeDocument/2006/docPropsVTypes	http://www.w3.org/2001/XMLSchema-instance
http://www.w3.org/2001/XMLSchema	http://schemas.openxmlformats.org/spreadsheetml/2006/main
http://purl.oclc.org/ooxml/spreadsheetml/main	http://schemas.microsoft.com/office/excel/2006/main
http://schemas.microsoft.com/office/excel/2006/2	http://www.w3.org/TR/REC-html40
http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument	http://sheetjs.openxmlformats.org/officeDocument/2006/relationships/officeDocument
http://schemas.openxmlformats.org/officeDocument/2006/relationships/hyperlink	http://schemas.openxmlformats.org/officeDocument/2006/relationships/vmlDrawing
http://schemas.openxmlformats.org/officeDocument/2006/relationships/externalLinkPath	http://schemas.microsoft.com/office/2006/relationships/xlExternalLinkPath/xlPathMissing
http://schemas.openxmlformats.org/officeDocument/2006/relationships/externalLink	http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXml
http://schemas.openxmlformats.org/officeDocument/2006/relationships/customXmlProps	http://schemas.openxmlformats.org/officeDocument/2006/relationships/comments
http://schemas.openxmlformats.org/package/2006/relationships/metadata/core-properties	http://schemas.openxmlformats.org/officeDocument/2006/relationships/extended-properties
http://schemas.openxmlformats.org/officeDocument/2006/relationships/custom-properties	http://schemas.openxmlformats.org/officeDocument/2006/relationships/sharedStrings
http://schemas.openxmlformats.org/officeDocument/2006/relationships/styles	http://schemas.openxmlformats.org/officeDocument/2006/relationships/theme
http://schemas.openxmlformats.org/officeDocument/2006/relationships/chart	http://schemas.microsoft.com/office/2014/relationships/chartEx
http://schemas.openxmlformats.org/officeDocument/2006/relationships/chartsheet	http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet
http://purl.oclc.org/ooxml/officeDocument/relationships/worksheet	http://schemas.openxmlformats.org/officeDocument/2006/relationships/dialogsheet
http://schemas.microsoft.com/office/2006/relationships/xlMacrosheet	http://schemas.openxmlformats.org/officeDocument/2006/relationships/image
http://schemas.openxmlformats.org/officeDocument/2006/relationships/drawing	http://schemas.openxmlformats.org/officeDocument/2006/relationships/sheetMetadata
http://schemas.microsoft.com/office/2017/10/relationships/threadedComment	http://schemas.microsoft.com/office/2017/10/relationships/person
http://schemas.microsoft.com/office/2006/relationships/vbaProject	http://docs.oasis-open.org/ns/office/1.2/meta/
http://docs.oasis-open.org/ns/office/1.2/meta/pkg#	http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://schemas.openxmlformats.org/drawingml/2006/main	http://schemas.microsoft.com/office/spreadsheetml/2017/richdata
http://schemas.microsoft.com/office/spreadsheetml/2017/dynamicarray	http://openoffice.org/2004/office

Page 1 of 2

Raw Manifest

{
  "name": "__MSG_extName__",
  "icons": {
    "16": "assets/icon-512.png",
    "48": "assets/icon-512.png",
    "128": "assets/icon-512.png"
  },
  "action": {
    "default_icon": "assets/icon-512.png",
    "default_popup": "./dist/popup/index.html"
  },
  "version": "1.5.0",
  "background": {
    "service_worker": "./dist/background/index.mjs"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extDescription__",
  "permissions": [
    "storage",
    "webRequest",
    "unlimitedStorage"
  ],
  "homepage_url": "https://twlistwexport.extensionsfox.com/",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "./dist/contentScripts/index.global.js"
      ],
      "run_at": "document_end",
      "matches": [
        "https://*.twitter.com/*",
        "https://*.x.com/*"
      ]
    }
  ],
  "host_permissions": [
    "*://*.twitter.com/*",
    "*://*.x.com/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "dist/contentScripts/style.css",
        "assets/*"
      ]
    }
  ]
}

by ✦ Astarte

TwList - X/Twitter List Scraper

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (98 total):

Raw Manifest

Detections

Manifest Findings