[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Spongebobify

Version 1.0.0 View in Chrome Web Store

Last scanned: about 4 hours ago

Extension Details

Rating: 5.0 ★ (2 ratings)

Users: 28

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: This extension has very limited trust indicators with only 28 users and 2 ratings, making it difficult to assess reliability. The lack of developer information and company details raises additional concerns about accountability. The perfect 5.0 rating from only 2 reviews is not statistically meaningful for establishing trustworthiness.

Concerns: The primary concern is the broad content script injection capability that allows the extension to run code on every website you visit. This creates significant potential for data theft, credential harvesting, or malicious website modifications. The activeTab and contextMenus permissions, while individually moderate risk, become more concerning when combined with universal script injection. The use of Manifest V2 indicates outdated security practices, as newer extensions should be migrating to the more secure V3 standard.

Recommendations: Given the high-risk findings and limited trust factors, consider running this extension in a separate Chrome profile to isolate it from your main browsing activities and sensitive accounts. Before installation, verify the extension's legitimacy through the Chrome Web Store and check for user reviews mentioning suspicious behavior. Consider looking for alternative extensions with similar functionality that have better security practices, more users, and use Manifest V3. If you must use this extension, avoid visiting sensitive websites like banking or email while it's active.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Raw Manifest

{
  "name": "Spongebobify",
  "icons": {
    "16": "images/icon_16.png",
    "32": "images/icon_32.png",
    "48": "images/icon_48.png",
    "64": "images/icon_64.png",
    "128": "images/icon_128.png"
  },
  "author": "Nicholas Wang",
  "version": "1.0.0",
  "background": {
    "scripts": [
      "js/spongebobify.js"
    ],
    "persistent": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Easily Spongebobify your text by highlighting or pasting into this extension window",
  "permissions": [
    "activeTab",
    "contextMenus"
  ],
  "browser_action": {
    "default_icon": "images/icon_16.png",
    "default_popup": "popup.html"
  },
  "content_scripts": [
    {
      "js": [
        "js/popup.js"
      ],
      "matches": [
        "*://*/*"
      ]
    }
  ],
  "manifest_version": 2
}

by ✦ Astarte

Spongebobify

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (3 total):

Raw Manifest

Detections

Manifest Findings

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css	https://github.com/nicholaswang2000/Spongebobify
https://clients2.google.com/service/update2/crx