[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

BibTeX Connect – Powered by CiteDrive

Version 5.1.0 View in Chrome Web Store

Last scanned: about 10 hours ago

Extension Details

Developer: citedrive.com

Rating: 4.0 ★ (6 ratings)

Users: 4,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a moderate user base of 4,000 users and maintains a decent 4.0-star rating, though based on only 6 reviews which limits reliability. The developer citedrive.com appears to be associated with academic citation management, which aligns with the extension's stated purpose. However, the low review count and relatively small user base provide limited validation of trustworthiness.

Concerns: The extension's permissions are extremely broad and concerning for its stated academic purpose. The combination of universal host permissions (https://*/*) and content script injection across all URLs creates significant security risks. For a BibTeX/citation management tool, accessing every website on the internet seems unnecessary and excessive. The ability to inject scripts into all websites could enable data theft, credential harvesting, or unauthorized website modifications. The storage permission, while reasonable for citation management, becomes more concerning when combined with the broad access capabilities.

Recommendations: Given the high-risk profile, consider running this extension in a separate Chrome profile dedicated to academic work only. Before installation, verify the legitimacy of citedrive.com and their privacy practices. Monitor the extension's behavior closely and consider alternative citation management tools with more restrictive permissions. If you must use this extension, disable it when not actively conducting research and avoid using it while accessing sensitive websites like banking or personal accounts.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "__MSG_extensionName__",
  "icons": {
    "16": "icon16.plasmo.6c567d50.png",
    "32": "icon32.plasmo.76b92899.png",
    "48": "icon48.plasmo.aced7582.png",
    "64": "icon64.plasmo.8bb5e6e0.png",
    "128": "icon128.plasmo.3c1ed2d2.png"
  },
  "action": {
    "default_icon": {
      "16": "icon16.plasmo.6c567d50.png",
      "32": "icon32.plasmo.76b92899.png",
      "48": "icon48.plasmo.aced7582.png",
      "64": "icon64.plasmo.8bb5e6e0.png",
      "128": "icon128.plasmo.3c1ed2d2.png"
    }
  },
  "author": "CiteDrive, Inc. /  Gareth Bilaney",
  "version": "5.1.0",
  "background": {
    "service_worker": "static/background/index.js"
  },
  "side_panel": {
    "default_path": "sidepanel.html"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extensionDescription__",
  "permissions": [
    "storage",
    "sidePanel"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "overleaf.01169ca2.js"
      ],
      "css": [],
      "matches": [
        "<all_urls>"
      ]
    },
    {
      "js": [
        "button.bd3de249.js"
      ],
      "css": [],
      "matches": [
        "<all_urls>"
      ]
    },
    {
      "js": [
        "get-metatags.32a7250e.js"
      ],
      "css": [],
      "matches": [
        "<all_urls>"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "https://*/*"
  ],
  "manifest_version": 3
}

by ✦ Astarte

https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/2000/svg
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xhtml
https://dx.doi.org/	https://www.citedrive.com/en/app/
https://clients2.google.com/service/update2/crx	https://api.citedrive.com
https://app.citedrive.com	http://127.0.0.1

BibTeX Connect – Powered by CiteDrive

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (12 total):

Raw Manifest

Detections

Manifest Findings