[ new scan ] [ statistics ] [ github ] [ twitter ]

Operata Collector

Version 1.7.29 View in Chrome Web Store

Last scanned: 14 days ago | force re-scan

Extension Details

Rating: 3.3 ★ (7 ratings)

Size: 1.12MiB

Last Updated: April 16, 2025

Users: 200,000

Developer Info: OPERATA, LLC2035 Sunset Lake Rd Ste B2 Newark, DE 19702 US

Context-Aware Verdict

HIGH

Risk Level

Trust Factors:

- The extension has a relatively high number of users (200,000), which could indicate some level of trust.

- The developer is a registered company (OPERATA, LLC), which adds some legitimacy.

- However, the extension has a low rating (3.3/5) with only 7 reviews, which raises some concerns.

Concerns:

- The extension requests broad host permissions (http://*/*, https://*/*), allowing it to access all websites. This is a significant privacy and security risk, as it could potentially be used to steal sensitive data or track browsing activity.

- The extension also requests system.cpu and system.memory permissions, which are not typically required for most extensions and could be a sign of potentially malicious behavior.

- The broad content scripts (http://*/*, https://*/*) further increase the risk of data exfiltration or browser hijacking.

Recommendations:

- Exercise caution when installing this extension, as it poses a high risk to your privacy and security due to its broad permissions and system access.

- If you must use this extension, consider running it in a separate Chrome profile or a sandboxed environment to isolate it from your main browsing activity.

- Closely monitor the extension's behavior and uninstall it if you notice any suspicious activity or performance issues.

- Seek alternative extensions with more limited permissions and better user reviews, if possible.

- Contact the developer for clarification on the necessity of the broad permissions and system access requested by the extension.

Security Analysis

MEDIUM

Overall Risk

Based on 1 total findings, ranked without considering overall context, including 1 high-risk and 0 medium-risk findings.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

Security Analysis Details

Required Permissions:

system.cpu
system.memory

Host Permissions:

http://*/*
https://*/*

Content Security Policy:

extension_pages: default-src 'none'; font-src 'self' data:; img-src * data: blob:; media-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src https://api.operata.io https://api-dev.operata.io;

Embedded URLs (47 total):

https://api.operata.io/collector/config	https://push.operata.io
https://api.operata.io/heartbeat/agent/recording	https://agent-service.operata.io/
https://github.com/pd4d10/system-monitor/blob/master/src/utils.js	https://api.operata.io
https://clients2.google.com/service/update2/crx	https://api-dev.operata.io
https://static.operata.io/welcomeMessage_	https://cdn.webrtc-experiment.com/gif-recorder.js
https://static.operata.io/12s_IRS_48k.wav	https://feross.org
https://feross.org/opensource	https://github.com/winstonjs/winston.git
https://github.com/winstonjs/winston/blob/master/UPGRADE-3.0.md	http://feross.org
https://example.com	https://github.com/winstonjs/winston/tree/master/UPGRADE-3.0.md
https://www.npmjs.com/package/sdp	https://github.com/gnaudio/jabra-browser-integration
https://google.com/chrome	https://chrome.google.com/webstore/detail/
https://stackoverflow.com/questions/10473745/compare-strings-javascript-return-of-likely	https://bugzilla.mozilla.org/show_bug.cgi?id=934425
https://gnaudio.visualstudio.com/AmazonConnect/_git/AmazonConnect	http://jedwatson.github.io/classnames
http://www.w3.org/2000/svg	https://static.operata.io/widget-assets/resolve_mic_not_shared.gif
https://help.operata.io/en/	https://media.giphy.com/media/pYyFAHLW0zJL2/giphy.gif
https://www.speedtest.net/	https://static.operata.io/widget-assets/resolve_shutdown_app_2.gif
https://static.operata.io/widget-assets/device_change.png	https://redux.js.org/api-reference/store#subscribelistener
https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/1999/xhtml
http://www.w3.org/1998/Math/MathML	https://reactjs.org/link/react-polyfills
http://fb.me/use-check-prop-types	https://github.com/cssinjs/jss
https://material-ui.com/production-error/?code=	https://operata.com/
https://www.youtube.com/embed/	https://giphy.com/gifs/connection-wireless-acquired-pYyFAHLW0zJL2
https://socket.io/docs/v3/migrating-from-2-x-to-3-0/

Raw Manifest

{
  "name": "Operata Collector",
  "icons": {
    "16": "assets/icons/operata16.png",
    "48": "assets/icons/operata48.png",
    "128": "assets/icons/operata128.png"
  },
  "version": "1.7.29",
  "background": {
    "service_worker": "dist/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "A browser based data collector and agent messenger for alerting and reporting issues.",
  "permissions": [
    "system.cpu",
    "system.memory"
  ],
  "content_scripts": [
    {
      "js": [
        "dist/override.js"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "dist/bridge.js"
      ],
      "run_at": "document_end",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "default-src 'none'; font-src 'self' data:; img-src * data: blob:; media-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src https://api.operata.io https://api-dev.operata.io; "
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "pc-override.js",
        "operata.js",
        "init-operata.js",
        "js-event-bus.min.js",
        "operata-agent-messenger.js",
        "operata-agent-messenger.css",
        "operata-agent-messenger-next.js",
        "operata-agent-messenger-next.css",
        "operata-logging-lib.js",
        "connect-rtc-1.1.7.min.js",
        "socket.io.min.js",
        "jabra.browser.integration-3.0.js",
        "jabra.connect.integration.v1.1.2.js",
        "operata-heartbeat-audio.js",
        "adaptors/*.js"
      ]
    }
  ]
}