[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Traffic Lite

Version 1.5.19 View in Chrome Web Store

Last scanned: about 13 hours ago

Extension Details

Developer: http://www.trafficliteedu.com/

Rating: 5.0 ★ (5 ratings)

Users: 93

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has very limited adoption with only 93 users and 5 ratings, which provides insufficient data to establish trustworthiness. While it maintains a perfect 5.0 rating, this is based on an extremely small sample size. The educational domain (trafficliteedu.com) suggests legitimate educational intent, but the low user base raises questions about the extension's maturity and reliability.

Concerns: The extension requests excessive permissions that appear disproportionate to its likely educational purpose. The identity permission is particularly concerning as it can access user authentication data. The tabs permission allows manipulation of all browser tabs, while the broad host permissions extend access beyond the stated Google Classroom integration. The combination of scripting permissions with external host access to railway.app and netlify.app domains creates potential data exfiltration pathways. For an educational tool, these permissions seem unnecessarily invasive.

Recommendations: Given the high-risk permissions and limited user base, consider running this extension in a separate Chrome profile to isolate potential security risks. Before installation, verify the extension's legitimacy by checking the developer's website and ensuring it's actually needed for your educational activities. Monitor the extension's network activity if possible, and consider alternative, more established educational tools for Google Classroom integration. The risk may not justify the benefits given the available alternatives.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: identity

This extension has the identity permission. Can access your identity information. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

storage
identity
alarms
activeTab
scripting
tabs
notifications
windows

Host Permissions:

https://traffic-lite-production.up.railway.app/*

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self';

Embedded URLs (16 total):

https://traffic-lite-production.up.railway.app	http://www.w3.org/2000/svg
https://traffic-lite-production.up.railway.app/api	https://traffic-lite-production.netlify.app/#/dashboard?token=
https://traffic-lite-production.netlify.app	https://fonts.googleapis.com/css2?family=Raleway:wght@300
https://clients2.google.com/service/update2/crx	https://traffic-lite-production.up.railway.app/
https://traffic-lite-production.netlify.app/	https://classroom.google.com/
https://traffic-lite.netlify.app/	https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile	https://www.googleapis.com/auth/classroom.courses.readonly
https://www.googleapis.com/auth/classroom.rosters.readonly	https://www.googleapis.com/auth/classroom.profile.emails

Raw Manifest

{
  "name": "Traffic Lite",
  "icons": {
    "16": "icons/icon-16.png",
    "32": "icons/icon-32.png",
    "48": "icons/icon-48.png",
    "128": "icons/icon-128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/icon-16.png",
      "32": "icons/icon-32.png",
      "48": "icons/icon-48.png",
      "128": "icons/icon-128.png"
    },
    "default_title": "Traffic Lite"
  },
  "oauth2": {
    "scopes": [
      "https://www.googleapis.com/auth/userinfo.email",
      "https://www.googleapis.com/auth/userinfo.profile",
      "https://www.googleapis.com/auth/classroom.courses.readonly",
      "https://www.googleapis.com/auth/classroom.rosters.readonly",
      "https://www.googleapis.com/auth/classroom.profile.emails"
    ],
    "client_id": "843056785250-sg728vdapvg1t09oka4oldlh09i5v8ui.apps.googleusercontent.com"
  },
  "version": "1.5.19",
  "background": {
    "type": "module",
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "AI Policy Governance for Schools, Embedded in Google Classroom",
  "permissions": [
    "storage",
    "identity",
    "alarms",
    "activeTab",
    "scripting",
    "tabs",
    "notifications",
    "windows"
  ],
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "matches": [
        "https://classroom.google.com/*"
      ]
    },
    {
      "js": [
        "aiScale.classroom.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://classroom.google.com/*"
      ]
    },
    {
      "js": [
        "contentScriptAuthBridge.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://traffic-lite-production.netlify.app/*",
        "https://traffic-lite.netlify.app/*"
      ]
    }
  ],
  "host_permissions": [
    "https://traffic-lite-production.up.railway.app/*"
  ],
  "manifest_version": 3,
  "externally_connectable": {
    "matches": [
      "https://traffic-lite-production.netlify.app/*",
      "https://*.netlify.app/*"
    ]
  },
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self';"
  }
}

by ✦ Astarte

Traffic Lite

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (16 total):

Raw Manifest

Detections

Manifest Findings