[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Starting analysis...

MTurk Suite

Version 3.3.2 View in Chrome Web Store

Last scanned: over 1 year ago | force re-scan

Extension Details

Developer: mturksuite.com

Rating: 4.0 ★ (126 ratings)

Size: 6.96MiB

Last Updated: March 29, 2023

Users: 10,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

- The extension has a relatively high number of users (10,000) and a decent rating (4.0/5), which suggests some level of trust from the user community.

- However, the developer information is limited, and there is no clear indication of a reputable company behind the extension.

Concerns:

- The extension requests a broad range of permissions, including the ability to access all websites (<all_urls>), modify clipboard data, access and modify cookies, track web navigation, intercept and modify web requests, and inject scripts into any website.

- While some of these permissions may be necessary for the extension's functionality, the combination of these powerful permissions raises significant privacy and security concerns.

- The extension uses the older Manifest Version 2, which has fewer security restrictions than the newer Manifest V3.

Recommendations:

- Exercise caution when using this extension, as it has the potential to compromise your privacy and security.

- Consider running the extension in a separate browser profile or a sandboxed environment to isolate its activities from your main browsing session.

- Regularly review the extension's permissions and activities to ensure it is not engaging in any unauthorized or suspicious behavior.

- If possible, consider using alternative extensions from more reputable developers that request fewer permissions or use the more secure Manifest V3.

- Keep the extension updated to the latest version and monitor for any security advisories or updates from the developer.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Dangerous Permission Combination: webRequest + webRequestBlocking

This extension can intercept, modify, and block web requests in real-time. This combination could be used to modify sensitive web traffic or steal data.

HIGH

High-Risk Permission: <all_urls>

This extension has the <all_urls> permission. Can access all websites and their content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequestBlocking

This extension has the webRequestBlocking permission. Can block and modify web requests in real-time. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

<all_urls>
activeTab
contextMenus
clipboardWrite
cookies
notifications
storage
tabs
webNavigation
webRequest
webRequestBlocking

Embedded URLs (131 total):

https://clients2.google.com/service/update2/crx	https://www.amazon.com/ap/signin
http://momentjs.com/guides/#/warnings/define-locale/	http://momentjs.com/guides/#/warnings/js-date/
http://momentjs.com/guides/#/warnings/min-max/	http://momentjs.com/guides/#/warnings/add-inverted-param/
http://momentjs.com/guides/#/warnings/zone/	http://momentjs.com/guides/#/warnings/dst-shifted/
https://bit.ly/3cXEKWf	https://redux.js.org/api-reference/store#subscribelistener
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	https://view.turkerview.com/v1/mts/advanced_queue/
https://view.turkerview.com/docs/bridge/rejections/	https://view.turkerview.com/v1/hits/hit/
https://view.turkerview.com/v1/hits/hit/info/?hit_set_id=	https://view.turkerview.com/v1/hits/
https://view.turkerview.com/v1/returns/retrieve/?hit_set_id=	https://view.turkerview.com/v1/requesters/?requester_ids=
https://view.turkerview.com/v1/requesters/rejections/?requester_id=	https://turkerview.com/api/v1/users/ignore/?user_id=
https://turkerview.com/api/v2/bridge/rejections/submit/	https://forum.turkerview.com/export.php
https://turkerview.com/api/v2/returns/submit/	https://turkerview.com/api/v2/reviews/submit/
https://turkerview.com/api/v2/reviews/update/	https://worker.mturk.com
https://www.mturkcrowd.com/forums/daily-work-threads.4/	https://www.mturkcrowd.com/threads/
http://bit.ly/2kdckMn	https://github.com/dfahlander/Dexie.js/wiki/Deprecations.
https://github.com/jsmreese/moment-duration-format	http://momentjs.com/
https://worker.mturk.com/projects/	https://worker.mturk.com/requesters/
https://worker.mturk.com/contact_requester/hit_type_messages/new?hit_type_message	https://turkerview.com/requesters/
https://turkopticon.net/	https://worker.mturk.com/qualifications/assigned
https://worker.mturk.com/qualifications/	http://www.w3.org/2000/svg
http://www.w3.org/1999/xlink	https://darkreader.org
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage	https://reactjs.org/docs/error-decoder.html?invariant=
http://www.w3.org/XML/1998/namespace	http://www.w3.org/1999/xhtml
http://www.w3.org/1998/Math/MathML	https://fb.me/react-polyfills
http://fb.me/use-check-prop-types	https://turkerview.com/api/v2/account/token/
https://turkerview.com/	https://blog.turkerview.com/mturk-suite-joins-turkerview/
https://turkerview.com/api/v2/mts/auth/	https://forum.turkerview.com/lost-password/
https://turkerview.com/docs/mts-auth/	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_lt-aee8a5c134dc67f013a5d6f458e70d1a1fcc6b0f85729ab334c4424160e874c8.eot
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_lt-aee8a5c134dc67f013a5d6f458e70d1a1fcc6b0f85729ab334c4424160e874c8.eot?#iefix	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_lt-34442033f72fa0b96588fe8bd2e84b288abcac57374ddfafbdaf920df19a8dd1.woff
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_lt-642c464a80c2633f6aac7648365bac307bdfcd90983951d34a5b81835da7f004.ttf	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_lt-c49fba1b30062774a79d574129cb2e193c6d2624a7595247d2eacf8d2347d07c.svg#ember
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_ltit-1f4c4c325992b0d6d44d363d007085d62465a1c0dbbd18206f5aac391d4a8640.eot	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_ltit-1f4c4c325992b0d6d44d363d007085d62465a1c0dbbd18206f5aac391d4a8640.eot?#iefix
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_ltit-fed34fc80ac64324db2133e15d6981a403a9fba29c0862c86fc02715b6d58b2d.woff	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_ltit-b7b24a162e976b3297d7a893bf825601f77dd999eea5135790de0ee20ca63a70.ttf
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_ltit-a6546db203f33d0a78a0e37c641c02e21ada45b39c4b52f1be50c93be70861f0.svg#ember	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_rg-3ce51fb975385ef6d076a31c928d2e239e23f58b3dd592a37bce20da083661f2.eot
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_rg-3ce51fb975385ef6d076a31c928d2e239e23f58b3dd592a37bce20da083661f2.eot?#iefix	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_rg-b0e33963c6b444e89e6025b33c3b9ea06723d8838be271b8b211967d71ff74ae.woff
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_rg-72bd8df6f96f968768e80654a6945e32c78b2cb31b1bc1efd16012a0d600924e.ttf	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_rg-3b222479ddb57dd0b7e2e050afbd2d0a147d1466d6aa80172628649c2b8e6f31.svg#ember
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_rgit-68a31d5e7723bb642b99182ffb36a3cd489bfbbbc564ac936b23d60a22de729f.eot	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_rgit-68a31d5e7723bb642b99182ffb36a3cd489bfbbbc564ac936b23d60a22de729f.eot?#iefix
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_rgit-7a8c3ff163473fe3761d83aabaea9b7e0ba4294d0466f38058646fc066a4a4ab.woff	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_rgit-a0e4ad79fec10e9674701ffe78f9d0a2a47bdfc81d71536b0afeeb5c20f87797.ttf
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_rgit-cdd6ff8b9cabb0b16f89ea818e2b04993a8d3c4184b8075ec40b3e1d321050ec.svg#ember	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_bd-af5cacb089118e5ab4328693981d7551f5c92f37273b579aa6e1d45585310cfc.eot
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_bd-af5cacb089118e5ab4328693981d7551f5c92f37273b579aa6e1d45585310cfc.eot?#iefix	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_bd-0a7c27ca5b7ed1f8c09a97b2bb2da5e26ccc015064b7258410064f4fa6f576a0.woff
https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_bd-d58152408f2ee981a4b1a7b7a4ef4e83d3286ed1595016a4e5128dba41ffc7a0.ttf	https://ddvx2zdcut4vw.cloudfront.net/assets/amazonember_bd-2525aec1777d471040e4db0969adf91b75592938a921d44e7a9eaec07132edcf.svg#ember

Page 1 of 2

Raw Manifest

{
  "name": "MTurk Suite",
  "icons": {
    "16": "@assets/images/icon.png",
    "48": "@assets/images/icon.png",
    "128": "@assets/images/icon.png"
  },
  "author": "Brandon Hellman",
  "version": "3.3.2",
  "background": {
    "scripts": [
      "background/background.js"
    ],
    "persistent": true
  },
  "options_ui": {
    "page": "options/options.html",
    "open_in_tab": true
  },
  "short_name": "MTS",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "An extension that improves the Amazon Mechanical Turk (MTurk) website.",
  "permissions": [
    "<all_urls>",
    "activeTab",
    "contextMenus",
    "clipboardWrite",
    "cookies",
    "notifications",
    "storage",
    "tabs",
    "webNavigation",
    "webRequest",
    "webRequestBlocking"
  ],
  "browser_action": {
    "default_icon": "@assets/images/icon.png",
    "default_title": "MTurk Suite"
  },
  "content_scripts": [
    {
      "js": [
        "scripts/mturksuite.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "exclude_matches": [
        "https://*.mturk.com/direct_deposit*",
        "https://*.mturk.com/payment_schedule*",
        "https://www.amazon.com/ap/signin*"
      ]
    },
    {
      "js": [
        "mturk/mturk.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.mturk.com/*"
      ],
      "exclude_matches": [
        "https://*.mturk.com/direct_deposit*",
        "https://*.mturk.com/payment_schedule*"
      ]
    },
    {
      "js": [
        "mturk-contact-requester/mturk-contact-requester.js"
      ],
      "run_at": "document_end",
      "matches": [
        "https://*.mturk.com/contact_requester/hit_type_messages/new*"
      ]
    },
    {
      "js": [
        "mturk-dashboard/mturk-dashboard.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.mturk.com/dashboard*"
      ]
    },
    {
      "js": [
        "mturk-projects/mturk-projects.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.mturk.com/",
        "https://*.mturk.com/?*",
        "https://*.mturk.com/projects",
        "https://*.mturk.com/projects/",
        "https://*.mturk.com/projects?*",
        "https://*.mturk.com/projects/?*",
        "https://*.mturk.com/requesters/*/projects*"
      ]
    },
    {
      "js": [
        "mturk-queue/mturk-queue.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.mturk.com/tasks*"
      ]
    },
    {
      "js": [
        "mturk-status-details/mturk-status-details.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.mturk.com/status_details/*"
      ]
    },
    {
      "js": [
        "mturk-task/mturk-task.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.mturk.com/projects/*/tasks*"
      ]
    },
    {
      "js": [
        "mturk-task/mturk-task-assigned.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.mturk.com/projects/*/tasks/*?assignment_id=*"
      ]
    },
    {
      "js": [
        "mturk-task/mturk-task-requester.js"
      ],
      "run_at": "document_start",
      "matches": [
        "https://*.mturk.com/projects/*/tasks*"
      ]
    },
    {
      "js": [
        "sidebar/sidebar.js"
      ],
      "run_at": "document_end",
      "matches": [
        "<all_urls>"
      ],
      "exclude_matches": [
        "https://*.mturk.com/direct_deposit*",
        "https://*.mturk.com/payment_schedule*",
        "https://www.amazon.com/ap/signin*"
      ]
    },
    {
      "js": [
        "theme/theme.js"
      ],
      "run_at": "document_start",
      "matches": [
        "<all_urls>"
      ],
      "all_frames": true,
      "exclude_matches": [
        "https://*.mturk.com/direct_deposit*",
        "https://*.mturk.com/payment_schedule*",
        "https://www.amazon.com/ap/signin*"
      ]
    }
  ],
  "manifest_version": 2,
  "web_accessible_resources": [
    "@assets/*",
    "@css/*",
    "sidebar/pages/sidebar.html",
    "catcher/catcher.html",
    "finder/finder.html",
    "tracker/tracker.html"
  ]
}

by ✦ Astarte

MTurk Suite

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (131 total):

Raw Manifest

Detections

Manifest Findings