[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Web Capture - HTML to React with MagicPath

Version 1.0.0 View in Chrome Web Store

Last scanned: 12 days ago | force re-scan

Extension Details

Developer: magicpath.ai

Rating: 4.2 ★ (25 ratings)

Users: 1,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a moderate user base of 1,000 users with a decent 4.2-star rating from 25 reviews, suggesting some level of user satisfaction. The developer is associated with magicpath.ai, which appears to be a legitimate AI-focused company. However, this is version 1.0.0, indicating it's a new release that may not have been thoroughly tested in the wild.

Concerns: The extension's permissions are extremely broad and concerning for its stated purpose of HTML to React conversion. The combination of all_urls host permissions and content script injection across all websites creates significant attack surface. The clipboardWrite permission could be misused to inject malicious content. Most concerning is that these extensive permissions seem unnecessary - a legitimate HTML-to-React tool should only need access to specific pages when actively being used, not blanket access to all websites.

The security findings reveal a pattern of overprivileged access that far exceeds what would be expected for a development tool. The broad content script injection capability means this extension can read sensitive data from banking sites, email, and other private web applications.

Recommendations: Run this extension in a completely separate Chrome profile isolated from your main browsing activities. Only enable it when specifically needed for development work. Consider alternative tools that require fewer permissions. Monitor your clipboard content after use and regularly review what data this extension might be accessing across your browsing sessions.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
activeTab
clipboardWrite

Host Permissions:

<all_urls>

Embedded URLs (15 total):

http://www.w3.org/2000/svg	https://clients2.google.com/service/update2/crx
https://magicpath.ai/	https://api.magicpath.ai
https://www.magicpath.ai	https://fonts.googleapis.com/css2?family=Geist:wght@400&display=swap
https://tailwindcss.com	https://react.dev/errors/
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	https://json-schema.org/draft/2020-12/schema
http://json-schema.org/draft-07/schema#	http://json-schema.org/draft-04/schema#
https://youtu.be/6gxnTIGjCQc

Raw Manifest

{
  "env": {
    "API_URL": "https://api.magicpath.ai",
    "WEB_URL": "https://www.magicpath.ai"
  },
  "name": "Web Capture - HTML to React with MagicPath",
  "icons": {
    "16": "icons/icon-16.png",
    "32": "icons/icon-32.png",
    "48": "icons/icon-48.png",
    "128": "icons/icon-128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/icon-16.png",
      "24": "icons/icon-24.png",
      "32": "icons/icon-32.png",
      "48": "icons/icon-48.png",
      "128": "icons/icon-128.png"
    },
    "default_popup": "index.html"
  },
  "version": "1.0.0",
  "background": {
    "service_worker": "service-worker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Capture elements from the web. Convert elements into interactive React components and edit manually or with AI on a canvas.",
  "permissions": [
    "storage",
    "activeTab",
    "clipboardWrite"
  ],
  "content_scripts": [
    {
      "js": [
        "injected/contentScript.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://magicpath.ai/*",
      "https://*.magicpath.ai/*"
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "injected/selectionOverlay.css",
        "injected/newExtractor.js",
        "injected/StyleExtractor.js"
      ]
    }
  ]
}

by ✦ Astarte

Web Capture - HTML to React with MagicPath

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (15 total):

Raw Manifest

Detections

Manifest Findings