[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Torrent Stream

Version 0.0.0.7 View in Chrome Web Store

Last scanned: about 7 hours ago

Extension Details

Rating: 3.4 ★ (330 ratings)

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

The extension has a concerning trust profile with a low rating of 3.4 out of 5 stars from 330 reviews, suggesting user dissatisfaction. The lack of clear author information and developer details raises transparency concerns. The name "Torrent Stream" suggests functionality related to torrenting, which often operates in legal gray areas and may expose users to copyright infringement risks.

Concerns:

The most significant red flag is the overly broad "http://*/" permission, which grants access to all HTTP websites - far exceeding what's necessary for torrent streaming functionality. This creates potential for data harvesting, credential theft, or malicious redirects. The extension uses the deprecated Manifest V2, which has weaker security protections than V3. The combination of storage, notifications, and context menu permissions, while individually reasonable, becomes concerning when paired with the excessive web access. The low version number (0.0.0.7) suggests this is early-stage software that may contain bugs or security vulnerabilities.

Recommendations:

Run this extension in a completely separate Chrome profile to isolate potential risks from your main browsing data. Avoid entering sensitive information while the extension is active. Consider using established, well-reviewed torrent clients instead of browser extensions for this functionality. Monitor your network traffic for unexpected connections. If you must use it, regularly review what data the extension has stored and disable it when not actively needed.

Findings

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

storage
contextMenus
notifications
fullscreen
http://*/

Embedded URLs (44 total):

https://clients2.google.com/service/update2/crx	http://getbootstrap.com
https://github.com/twbs/bootstrap/blob/master/LICENSE	https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
https://dbtek.github.io/bootstrap-vertical-tabs	http://videogular.com
http://twofuckingdevelopers.com	http://www.alessioatzeni.com/blog/css3-loading-animation-loop/
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/2000/svg
https://chrome.google.com/webstore/detail/torrentstream-helper/ebaaacomjclfgnkmaeaneljmfgkofphc	https://github.com/rvagg
https://github.com/chesles/	https://github.com/raynos
https://github.com/dominictarr	https://github.com/maxogden
https://github.com/ralphtheninja	https://github.com/kesla
https://github.com/juliangruber	https://github.com/hij1nx
https://github.com/No9	https://github.com/mcollina
https://github.com/pgte	https://github.com/substack
https://github.com/rvagg/node-levelup.git	https://github.com/rvagg/node-levelup
https://github.com/rvagg/node-levelup/issues	http://registry.npmjs.org/levelup/-/levelup-0.18.6.tgz
https://registry.npmjs.org/levelup/-/levelup-0.18.6.tgz	http://github.com/dominictarr/crypto-browserify
https://github.com/indutny/elliptic/issues	https://github.com/indutny/elliptic
http://registry.npmjs.org/elliptic/-/elliptic-1.0.1.tgz	https://registry.npmjs.org/elliptic/-/elliptic-1.0.1.tgz
http://api.opensubtitles.org/xml-rpc	http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions
http://angularjs.org	http://errors.angularjs.org/1.3.13/
http://static.videogular.com/assets/videos/videogular.mp4	http://pubads.g.doubleclick.net/gampad/ads?sz=640x480&iu=%2F3510761%2FadRulesSampleTags&ciu_szs=160x600%2C300x250%2C728x90&cust_params=adrule%3Dpremidpostpodandbumpers&impl=s&gdfp_req=1&env=vp&ad_rule=1&vid=47570401&cmsid=481&output=xml_vast2&unviewed_position_start=1&url=
http://www.jacklmoore.com/notes/mouse-position/	https://gist.github.com/paulirish/211209

Raw Manifest

{
  "app": {
    "background": {
      "scripts": [
        "scripts/bg.js"
      ],
      "persistent": false
    }
  },
  "name": "Torrent Stream",
  "icons": {
    "16": "images/icon16.png",
    "48": "images/icon48.png",
    "64": "images/icon64.png",
    "128": "images/icon128.png"
  },
  "sockets": {
    "tcp": {
      "connect": "*"
    },
    "udp": {
      "bind": "*",
      "send": "*",
      "multicastMembership": ""
    },
    "tcpServer": {
      "listen": "*"
    }
  },
  "version": "0.0.0.7",
  "short_name": "Torrent Stream",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Watch h264 videos (mp4, some mkv) directly from torrents, without having to download them.",
  "permissions": [
    "storage",
    "contextMenus",
    "notifications",
    "fullscreen",
    "http://*/"
  ],
  "manifest_version": 2,
  "externally_connectable": {
    "ids": [
      "ebaaacomjclfgnkmaeaneljmfgkofphc"
    ]
  }
}

by ✦ Astarte

Torrent Stream

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (44 total):

Raw Manifest

Detections

Manifest Findings