[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

LTK Product Link

Version 0.18.3 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: https://creator.shopltk.com/

Rating: 2.2 ★ (31 ratings)

Users: 30,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

The extension has a concerning trust profile with only 30,000 users and a poor 2.2-star rating from 31 reviews, suggesting user dissatisfaction. The developer appears to be associated with LTK (formerly rewardStyle), a legitimate influencer marketing platform, which provides some credibility. However, the low rating indicates potential functionality or privacy issues that users have experienced.

Concerns:

The extension requests extremely broad permissions that seem excessive for a product linking tool. The combination of tabs permission with universal host permissions (http://*/*, https://*/*) creates significant privacy risks, allowing the extension to monitor and potentially manipulate all browsing activity across every website. The declarativeNetRequest permission could be used to modify network requests, while scripting permission enables code injection on any site. These capabilities far exceed what would be necessary for simply creating product links, raising questions about data collection practices and potential overreach.

Recommendations:

Given the high-risk permission set and poor user ratings, consider running this extension in a separate Chrome profile to isolate it from sensitive browsing activities. Before installation, carefully review LTK's privacy policy to understand data collection practices. Monitor the extension's behavior closely and consider alternatives with more limited permissions. If you must use it, disable it when not actively creating product links and regularly review what data it may have accessed through Chrome's extension management settings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

activeTab
tabs
storage
scripting
declarativeNetRequest

Host Permissions:

http://*/*
https://*/*

Embedded URLs (248 total):

https://fonts.googleapis.com/css?family=Bentham	https://fonts.ltk.rip/ivy-presto-display/ivy-presto-display.css
https://fonts.ltk.rip/sofia-pro/sofia-pro.css	https://fonts.shopltk.com/ivy-presto-display/ivy-presto-display.css
https://fonts.shopltk.com/sofia-pro/sofia-pro.css	http://www.w3.org/2000/svg
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd	http://mozilla.org/MPL/2.0/.
https://github.com/mozilla/webextension-polyfill/issues/130	http://shopltk.com/profile
https://onbrand.shopltk.com/us/influencergrowthservices/tools/buy-now	https://www.facebook.com/dialog/feed?app_id=381884648595671&display=popup&redirect_uri=https%3A%2F%2Fwww.facebook.com%2F&link=
https://twitter.com/intent/tweet?text=	https://pinterest.com/pin/create/button/?url=
http://service.weibo.com/share/share.php?url=	https://help.rewardstyle.com/hc/en-us/articles/4415906341787
https://chromewebstore.google.com/detail/ltk-product-link/ejgkcifglageljajmhjhbjieoocfmhgj?pli=1	http://auth0.com/oauth/grant-type/mfa-oob
http://auth0.com/oauth/grant-type/mfa-otp	http://auth0.com/oauth/grant-type/mfa-recovery-code
https://login.microsoftonline.com	https://auth0.com/docs/get-started/applications/configure-par
http://schemas.openid.net/event/backchannel-logout	http://auth0.com/oauth/token-type/federated-connection-access-token
https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin	https://www.datadoghq-browser-agent.com
https://www.datad0g-browser-agent.com	https://d3uc069fcn7uxw.cloudfront.net
https://d20xtzwzcl0ceb.cloudfront.net	https://docs.datadoghq.com
https://ltk.app.link/fLHsPHg3MR	https://ltk.app.link/1LZaa5FqXZ
http://www.w3.org/1999/xlink	https://www.facebook.com/LIKEtoKNOWit-1543485825863332/
https://www.youtube.com/channel/UCw_WZUDMPB0TDpWXtbowKKA/featured	https://www.instagram.com/shop.ltk/?hl=en
https://open.spotify.com/show/04Dm6V8gTu60JBeFYMlOMM	https://www.instagram.com/shop.LTK/?hl=en
https://www.instagram.com/ltk.home/	https://www.instagram.com/ltk.family/
https://www.instagram.com/ltk.europe/	https://www.instagram.com/ltk.brasil/
https://www.instagram.com/ltk.australia/	https://www.instagram.com/ltk.asia/
https://help.liketoknow.it/	https://github.com/focus-trap/tabbable/blob/master/LICENSE
https://github.com/focus-trap/focus-trap/blob/master/LICENSE	http://www.w3.org/1998/Math/MathML
https://v2.vuetifyjs.com/getting-started/quick-start#bootstrapping-the-vuetify-object	https://github.com/vuetifyjs/vuetify/issues/4068
https://github.com/vuetifyjs/vuetify/releases/tag/v2.0.0#user-content-upgrade-guide	https://fontawesome.com
https://fontawesome.com/license/free	https://developers.facebook.com/docs/sharing/reference/share-dialog
https://developer.twitter.com/en/docs/twitter-for-websites/tweet-button/guides/web-intent	https://developers.pinterest.com/docs/widgets/save/?
https://www.tumblr.com/docs/en/share_button	http://jssdk.sinaapp.com/widget/share.php
https://developers.google.com/+/web/share/	https://vk.com/dev/share_details
https://vk.com/dev/widget_share	https://github.com/salesforce/lwc/issues/1824
https://web.dev/same-site-same-origin/#site	https://developer.chrome.com/blog/page-lifecycle-api
https://docs.datadoghq.com/real_user_monitoring/session_replay/browser/privacy_options	https://docs.datadoghq.com/real_user_monitoring/platform/connect_rum_and_traces/?tab=browserrum
https://docs.datadoghq.com/logs/log_configuration/attributes_naming_convention/#user-related-attributes	https://docs.datadoghq.com/getting_started/tagging/#defining-tags
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Unicode_character_class_escape#browser_compatibility	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions/Unicode_character_class_escape#unicode_property_escapes_vs._character_classes
https://babeljs.io/docs/babel-plugin-transform-remove-console/	https://github.com/terser/terser#compress-options
https://github.com/angular/angular/tree/main/packages/zone.js	https://mathiasbynens.be/notes/globalthis
https://developer.chrome.com/blog/using-requestidlecallback#checking_for_requestidlecallback	https://github.com/csnover/TraceKit/blob/04530298073c3823de72deb0b97e7b38ca7bcb59/tracekit.js
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error#Error_types	https://gist.github.com/jed/982883
https://www.ietf.org/rfc/rfc2616.txt	https://www.ietf.org/rfc/rfc6265.txt

Page 1 of 4

Raw Manifest

{
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1QtojfqKn7bQJOSZ80YvdDvE3YNPBAnT0rWPbOAd8RXdpokk5Fc4rHBBzVD1cW8tRMSOIr2/30+hCd8J2bmMjPBQlYUbHrEx+knAPWQfCqe+OoZJEiF+GGWuCMdsniNyQeZSvo5uJS+5ANUqsz2hDHUenaERwwKh7fsFUcnu2f7nwrVNshGW8yL2IEHeaRE7gDIG/RfTggROR828FyYpmDJzTvT7L1/DnajjMeDzczBJyJ+p83Meb4Ks0E09E15yQsdfmOVwSe5SxtsKqGDwNBQv5f6JygJjr72PhYicodC6h6jDPfPw4/eMPwcDK6NmTD3Wt4QtVGfwtnYYWSPwvwIDAQAB",
  "name": "LTK Product Link",
  "icons": {
    "16": "icons/16.png",
    "32": "icons/32.png",
    "48": "icons/48.png",
    "128": "icons/128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/16.png",
      "24": "icons/24.png",
      "32": "icons/32.png"
    },
    "default_title": "LTK Product Link"
  },
  "version": "0.18.3",
  "background": {
    "service_worker": "js/background.js"
  },
  "short_name": "Product Link",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Get products to share on LTK from supported retailer's websites at the click of a button.",
  "permissions": [
    "activeTab",
    "tabs",
    "storage",
    "scripting",
    "declarativeNetRequest"
  ],
  "options_page": "options.html",
  "content_scripts": [
    {
      "js": [
        "js/content-script.js"
      ],
      "matches": [
        "http://*/*",
        "https://*/*"
      ]
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "minimum_chrome_version": "88",
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "iframe_blockers",
        "path": "config/rule_resources/iframe_blockers.json",
        "enabled": true
      }
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "*://*/*"
      ],
      "resources": [
        "popup.html"
      ]
    },
    {
      "matches": [
        "https://*.ltk.rip/*",
        "https://*.rewardstyle.com/*",
        "https://*.liketoknow.it/*",
        "https://*.qashopltk.com/*",
        "https://*.shopltk.com/*"
      ],
      "resources": [
        "options.html"
      ]
    }
  ]
}

by ✦ Astarte

LTK Product Link

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (248 total):

Raw Manifest

Detections

Manifest Findings