[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

PocketTube: Youtube PlayList Manager

Version 2.17.7 View in Chrome Web Store

Last scanned: about 2 months ago | force re-scan

Extension Details

Developer: https://pockettube.io/

Rating: 4.1 ★ (438 ratings)

Users: 30,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a moderate user base of 30,000 users and a decent 4.1-star rating from 438 reviews, suggesting legitimate functionality. The developer maintains a dedicated website (pockettube.io) which adds some credibility. However, the extension's purpose as a YouTube playlist manager doesn't fully justify some of the powerful permissions it requests.

Concerns: The identity permission is particularly concerning as it can access personal authentication information, which seems unnecessary for playlist management. The webRequest permission allows intercepting and modifying web traffic, creating potential for data theft or malicious modifications. While the host permissions are limited to YouTube domains, they're still quite broad. The unlimited storage permission could be used to hoard excessive data on your device.

The combination of identity access, web request interception, and broad YouTube permissions creates a significant attack surface. An attacker could potentially access your Google account information, monitor your YouTube activity, or inject malicious content.

Recommendations: Consider running this extension in a separate Chrome profile to isolate it from your main browsing session and other extensions. Before installing, verify that the advanced permissions are actually necessary for the playlist management features you need. Monitor the extension's behavior and remove it if you notice unusual network activity or performance issues. Consider alternative playlist managers with more limited permissions if this functionality isn't essential.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

alarms
storage
unlimitedStorage
identity
contextMenus
webRequest

Host Permissions:

https://*.youtube.com/*

Embedded URLs (148 total):

https://clients2.google.com/service/update2/crx	https://pockettube.io/
https://www.googleapis.com/auth/drive.appdata	https://www.googleapis.com/auth/youtube.readonly
https://www.youtube.com	https://www.youtube.com/youtubei/v1/browse/edit_playlist?key=
https://www.youtube.com/	https://www.youtube.com/watch_videos?title=
https://www.youtube.com/youtubei/v1/playlist/get_add_to_playlist?key=	https://www.youtube.com/channel/
https://www.youtube.com/youtubei/v1/browse?key=	https://www.youtube.com/youtubei/v1/playlist/create?key=
https://www.youtube.com/youtubei/v1/playlist/delete?key=	https://www.youtube.com/watch?v=
https://microsoftedge.microsoft.com/addons/detail/pockettube-youtube-playl/ehbcnddflnbfekidfnieclbpknhkelkj	https://apps.apple.com/us/app/id1592569440
https://addons.mozilla.org/en-US/firefox/addon/pockettube-youtube-playlist/	https://chromewebstore.google.com/detail/pockettube-youtube-playli/bplnofkhjdphoihfkfcddikgmecfehdd/reviews#:~:text=Write%20a%20review
https://pockettube.io/success-playlist.html?utm_source=opera	https://pockettube.io/success-playlist.html?utm_source=brave
https://pockettube.io/success-playlist.html?utm_source=yandex	https://pockettube.io/success-playlist.html?utm_source=edge
https://pockettube.io/success-playlist.html?utm_source=safari-new	https://pockettube.io/success-playlist.html?utm_source=firefox
https://pockettube.io/success-playlist.html?utm_source=chrome	https://pockettube.io/remove-playlist.html?utm_source=opera
https://pockettube.io/remove-playlist.html?utm_source=brave	https://pockettube.io/remove-playlist.html?utm_source=yandex
https://pockettube.io/remove-playlist.html?utm_source=edge	https://pockettube.io/remove-playlist.html?utm_source=safari
https://pockettube.io/remove-playlist.html?utm_source=firefox	https://pockettube.io/remove-playlist.html?utm_source=chrome
https://api.mixpanel.com/track?ip=1&data=	https://i.yousub.info/upload
https://imgur-apiv3.p.rapidapi.com/3/image	https://p.yousub.info/oauth/refresh-token?refresh_token=
https://p.yousub.info/oauth/get-user-data	https://p.yousub.info/paddle/email
https://p.yousub.info/backup	https://www.patreon.com/ysub?utm_source=context
https://www.buymeacoffee.com/ysub?utm_source=context	https://www.reddit.com/r/pockettube/
https://www.youtube.com/channel/UCTVgSQTwWpHWIXC6EOh8vWw?sub_confirmation=1	http://www.w3.org/2000/svg
https://www.youtube.com/youtubei/v1/like/removelike?key=	https://www.youtube.com/api/stats/playback?ns=yt&cpn=
https://www.youtube.com/feed/history/community_history	http://adamwdraper.github.com/Numeral-js/
https://github.com/facebook/regenerator/blob/main/LICENSE	https://www.youtube.com/getAccountSwitcherEndpoint
https://www.youtube.com/youtubei/v1/browse	https://www.youtube.com/watch?v=eb9AK-zzKXc
https://i.ytimg.com/vi/	http://www.example.com
https://b3781aacad8390e5f3adf6c0221db786@o416359.ingest.us.sentry.io/5310804	http://www.w3.org/1999/xlink
http://www.w3.org/1998/Math/MathML	https://github.com/SortableJS/Vue.Draggable/blob/master/documentation/migrate.md#element-props
https://github.com/SortableJS/Vue.Draggable/blob/master/documentation/migrate.md#options-props	https://github.com/zloirock/core-js/blob/v3.39.0/LICENSE
https://github.com/zloirock/core-js	https://v2.vuetifyjs.com/getting-started/quick-start#bootstrapping-the-vuetify-object
https://github.com/vuetifyjs/vuetify/issues/4068	https://github.com/vuetifyjs/vuetify/releases/tag/v2.0.0#user-content-upgrade-guide
https://api.mixpanel.com	https://www.flaticon.com/packs/music-52
https://www.flaticon.com/packs/computer-gaming-3	https://www.flaticon.com/packs/news-journal-2
https://www.flaticon.com/packs/rounded-multimedia	https://www.flaticon.com/packs/healthy-lifestyle-22
https://i.yousub.info/icon-search/	https://www.youtube.com/watch?v=JQCpYWp06sA&t=19s
https://youtube.com#ypm-patreon	https://www.youtube.com/playlist?list=
https://github.com/phphe	https://he-tree-vue.phphe.com
https://microsoftedge.microsoft.com/addons/detail/pockettube-youtube-subsc/klfeohnijmogpjoeenglhonjfiacajpp	https://pockettube.io/install/PocketTube.dmg
https://addons.mozilla.org/en-US/firefox/addon/youtube-subscription-groups/	https://chrome.google.com/webstore/detail/pockettube-youtube-subscr/kdmnjgijlmjgmimahnillepgcgeemffb

Page 1 of 2

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkxzL19Hk2fXGUg6lEw70iKrMXC9kP4Aq4YChYF7UDCqChYRSufSpKgicf3nu5TTXKtjW/2UgHoPd1hXmF4rthA26YM7C1TMJ7kahyLL57OJqgNlpV7Sr1Ba4bWHjzr3450YpmKtz6S2EjYFqQ5Dsy8OQBV3plxKcttTtVmDSExDCUhwH6ChZIps+wK/VHNBD4yRy1B+7DMb157yldQTGa8kqfJXCZ1edXkjOrfnxATU1XNhcQL+kPOpx93fdoWgqr7NCdLe1nBMi/7ChQAxhY2IOZkY4QKDxTIbrmn9i5xRjxTSK1b/MipcwY1wiVrVZlmJpQhGMCfITYgLEkU5BmQIDAQAB",
  "name": "__MSG_name__",
  "icons": {
    "16": "icon/icon_16.png",
    "48": "icon/icon_48.png",
    "128": "icon/icon_128.png"
  },
  "action": {
    "default_icon": {
      "16": "icon/icon_16.png",
      "48": "icon/icon_48.png",
      "128": "icon/icon_128.png"
    },
    "default_popup": "/pockettube-app/dist/index.html",
    "default_title": "PocketTube: Youtube PlayList Manager"
  },
  "author": "Dmitry Nabok",
  "oauth2": {
    "scopes": [
      "profile",
      "https://www.googleapis.com/auth/drive.appdata",
      "https://www.googleapis.com/auth/youtube.readonly"
    ],
    "client_id": "579336474196-vvopcc4b0to7aal97pab6pgpks89qb8b.apps.googleusercontent.com"
  },
  "version": "2.17.7",
  "background": {
    "service_worker": "/build/background.js"
  },
  "short_name": "YSM",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_description__",
  "permissions": [
    "alarms",
    "storage",
    "unlimitedStorage",
    "identity",
    "contextMenus",
    "webRequest"
  ],
  "homepage_url": "https://pockettube.io/",
  "options_page": "/pockettube-app/dist/index.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "/build/app.js",
        "/purify2.min.js"
      ],
      "css": [
        "context.css"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.youtube.com/*"
      ]
    }
  ],
  "host_permissions": [
    "https://*.youtube.com/*"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "https://*.youtube.com/*"
      ],
      "resources": [
        "/build/ut.js",
        "/purify2.min.js",
        "/pockettube-app/dist/*",
        "/page/login.html",
        "icon/*"
      ]
    }
  ]
}

by ✦ Astarte

PocketTube: Youtube PlayList Manager

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (148 total):

Raw Manifest

Detections

Manifest Findings