[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

NahNotToday Privacy & Security

Version 1.3.6 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Developer: warpcoredev.org

Rating: 5.0 ★ (2 ratings)

Users: 172

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors: The extension has extremely limited adoption with only 172 users and just 2 ratings, making it difficult to assess reliability through community feedback. The 5.0 rating is based on an insufficient sample size. The developer "warpcoredev.org" lacks established reputation or verifiable credentials. The extension claims to provide privacy and security benefits, but the extensive permissions contradict this stated purpose.

Concerns: The permission set is highly concerning for a privacy-focused extension. The combination of webRequest, webNavigation, and broad host permissions creates a powerful surveillance capability that could monitor, intercept, and modify all web traffic. The privacy permission allows modification of browser privacy settings, potentially weakening user protections. The declarativeNetRequest permissions combined with universal host access grants extensive control over network requests. These permissions far exceed what would be necessary for legitimate privacy protection and instead enable comprehensive user tracking and data interception.

Recommendations: Do not install this extension due to its critical risk level and contradictory nature. If privacy and security tools are needed, choose well-established extensions from reputable developers with transparent privacy policies and extensive user bases. The combination of invasive permissions with minimal user adoption and unknown developer reputation creates an unacceptable security risk. Consider using established privacy tools like uBlock Origin or Privacy Badger instead.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: privacy

This extension has the privacy permission. Can modify privacy settings. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "__MSG_extensionName__",
  "icons": {
    "16": "icons/icon16.png",
    "48": "icons/icon48.png",
    "128": "icons/icon128.png"
  },
  "action": {
    "default_popup": "popup/popup.html",
    "default_title": "__MSG_extensionName__"
  },
  "version": "1.3.6",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_extensionDescription__",
  "permissions": [
    "activeTab",
    "storage",
    "webNavigation",
    "scripting",
    "webRequest",
    "declarativeNetRequest",
    "declarativeNetRequestWithHostAccess",
    "privacy"
  ],
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "injects/inject-glcanvas.js",
        "injects/inject-audio.js",
        "injects/screenResolution.js"
      ],
      "world": "MAIN",
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "content.js"
      ],
      "world": "ISOLATED",
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true
    }
  ],
  "host_permissions": [
    "http://*/*",
    "https://*/*"
  ],
  "manifest_version": 3,
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "ruleset_1",
        "path": "rules.json",
        "enabled": true
      }
    ]
  }
}

by ✦ Astarte

https://ipinfo.io/json	http://ip-api.com/json
https://clients2.google.com/service/update2/crx	https://nowpayments.io/donation/warpcoredev

NahNotToday Privacy & Security

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (4 total):

Raw Manifest

Detections

Manifest Findings