[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Dashcam

Version 0.2.2 View in Chrome Web Store

Last scanned: about 12 hours ago

Extension Details

Developer: Haxor Inc

Rating: 4.3 ★

Users: 199

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 5 total findings, including 4 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: https://github.com/, https://bitbucket.org/. Ensure you trust this extension with access to these sites.

Security Analysis Details

Required Permissions:

webNavigation
scripting
webRequest

Host Permissions:

<all_urls>
https://github.com/
https://bitbucket.org/
https://*.atlassian.net/
https://*.height.app/

Embedded URLs (35 total):

https://airtable.com/appqfL3QcYxkdT7nt/shr4qp2F8GJgvp1y2	https://clients2.google.com/service/update2/crx
https://github.com/	https://bitbucket.org/
https://replayable.us.auth0.com	https://github.com/nodejs/node/commit/2a51ae424a513ec9a6aa3466baa0cc1d55dd4f3b
http://narwhaljs.org	https://github.com/nodejs/node/commit/0817840f775032169ddd70c85ac059f18ffcc81c
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/repeat
https://github.com/nodejs/node/commit/3b044962c48fe313905877a96b5d0894a5404f6f	https://github.com/nodejs/node/blob/v10.8.0/lib/internal/errors.js
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/startsWith	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/includes
https://github.com/nodejs/node/commit/112cc7c27551254aa2b17098fb774867f05ed0d9	https://github.com/feross/buffer/blob/680e9e5e488f22aac27599a57dc844a6315928dd/index.js
http://feross.org	https://tc39.github.io/ecma262/#sec-object.prototype.tostring
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#Loose_equality_using	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/assign
https://github.com/tc39/proposal-shadowrealm/pull/384#issuecomment-1364264229	https://github.com/lodash/lodash/blob/4.17.15/dist/lodash.js#L6735-L6744
https://github.com/ljharb/object.assign/issues/17	https://github.com/WebReflection/get-own-property-symbols/issues/4
http://www.ecma-international.org/ecma-262/6.0/#sec-number.isnan	https://github.com/es-shims/es5-shim
https://github.com/sindresorhus/p-is-promise/blob/cda35a513bda03f977ad5cde3a079d237e82d7ef/index.js	http://en.wikipedia.org/wiki/ANSI_escape_code#graphics
http://msdn.microsoft.com/en-us/library/ie/dww52sbt	https://goo.gl/t5IS6M
https://developer.chrome.com/extensions/background_pages	https://developer.chrome.com/docs/extensions/reference/webNavigation/
https://docs.dashcam.io/replayable/setup/installation	https://dashcam.io/
http://www.w3.org/2000/svg

Raw Manifest

{
  "name": "Dashcam",
  "icons": {
    "128": "icons/128.png"
  },
  "action": {
    "default_popup": "popup/popup.html",
    "default_title": "Dashcam"
  },
  "version": "0.2.2",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Why double-back when you can capture it the first time? Playback and share whatever happens with Dashcam's desktop replay buffer.",
  "permissions": [
    "webNavigation",
    "scripting",
    "webRequest"
  ],
  "content_scripts": [
    {
      "js": [
        "./replayable/index.js"
      ],
      "css": [
        "./replayable/index.css"
      ],
      "matches": [
        "*://github.com/*/issues/*",
        "*://github.com/*/pull/*",
        "*://github.com/*/compare/*",
        "*://bitbucket.org/*/pull-requests/*",
        "*://*.atlassian.net/*",
        "*://*.height.app/*/T-*",
        "*://*.height.app/T-*"
      ],
      "all_frames": true,
      "content_security_policy": "script-src 'self' https://replayable.us.auth0.com; object-src 'self'"
    },
    {
      "js": [
        "./logs/index.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "<all_urls>",
    "https://github.com/",
    "https://bitbucket.org/",
    "https://*.atlassian.net/",
    "https://*.height.app/"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "https://github.com/*",
        "https://bitbucket.org/*",
        "https://*.atlassian.net/*",
        "https://*.height.app/*"
      ],
      "resources": [
        "shared/*",
        "replayable/*"
      ]
    },
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "logs/*"
      ]
    }
  ]
}

by ✦ Astarte

Dashcam

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (35 total):

Raw Manifest

Detections

Manifest Findings