[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Ethiq

Version 0.1.9 View in Chrome Web Store

Last scanned: about 4 hours ago

Extension Details

Developer: ethiq.com

Rating: 5.0 ★ (6 ratings)

Users: 1,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a perfect 5.0 rating but only 6 reviews, which is insufficient to establish reliability. With only 1,000 users and no clear description provided, the extension lacks transparency about its purpose and functionality. The developer domain "ethiq.com" doesn't provide enough context about the company's reputation or legitimacy.

Concerns: The most significant concern is the broad content script injection capability across all URLs, which creates substantial security risks for credential theft and data manipulation. The combination of unlimited storage permissions with broad site access is particularly concerning, as it could enable extensive data collection and storage without user awareness. The lack of a clear description makes it impossible to determine if these powerful permissions are justified for the extension's intended functionality. Using the older Manifest V2 provides fewer security safeguards compared to modern standards.

Recommendations: Given the high-risk permissions and lack of transparency, consider running this extension in a separate Chrome profile to isolate potential security risks. Before installation, research the developer and extension purpose more thoroughly. Monitor your browsing behavior and sensitive account activities if you choose to use this extension. Consider looking for alternative extensions with similar functionality but more transparent permissions and better documentation. The broad content script access combined with unlimited storage makes this extension potentially dangerous for everyday browsing.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

storage
unlimitedStorage

Content Security Policy:

script-src 'self' https://*.google-analytics.com; object-src 'self'

Embedded URLs (48 total):

https://www.ethiq.com	https://www.googletagmanager.com/gtag/js
https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/1999/xhtml
http://www.w3.org/2000/svg	http://www.w3.org/1998/Math/MathML
https://reactjs.org/link/react-polyfills	http://fb.me/use-check-prop-types
https://fb.me/react-async-component-lifecycle-hooks	https://ethiq.nyc3.cdn.digitaloceanspaces.com
http://jqueryui.com	http://jquery.org/license
http://api.jqueryui.com/category/ui-core/	https://stackoverflow.com/questions/4328500/how-can-i-strip-all-punctuation-from-a-string-in-javascript-using-regex
http://fb.me/prop-types-in-prod	https://bugs.chromium.org/p/v8/issues/detail?id=4118
https://bugs.chromium.org/p/v8/issues/detail?id=3056	http://cldr.unicode.org/translation/date-time-1/date-time#TOC-Standalone-vs.-Format-Styles
https://bugs.chromium.org/p/chromium/issues/detail?id=1025564&can=2&q=%2224%3A00%22%20datetimeformat	https://github.com/wooorm/bcp-47
https://en.wikipedia.org/wiki/ISO_8601#Durations	https://en.wikipedia.org/wiki/ISO_8601#Times
https://stackoverflow.com/questions/588004/is-floating-point-math-broken	https://en.wikipedia.org/wiki/ISO_8601#Time_intervals
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/DateTimeFormat	https://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.3.1
https://moment.github.io/luxon/#/parsing?id=table-of-tokens	https://en.wikipedia.org/wiki/ISO_week_date
https://moment.github.io/luxon/#/formatting?id=table-of-tokens	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/DateTimeFormat/formatToParts
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-generatorresume	https://github.com/facebook/regenerator/issues/274
http://www.google.com	https://developers.google.com/gtagjs/reference/api
https://developers.google.com/tag-platform/gtagjs/reference	https://developers.google.com/analytics/devguides/collection/analyticsjs/field-reference#cookieUpdate
https://developers.google.com/analytics/devguides/collection/gtagjs/cookies-user-id#cookie_update	https://support.google.com/analytics/answer/2853546?hl=en#zippy=%2Cin-this-article
https://support.google.com/analytics/answer/9050852?hl=en	https://support.google.com/analytics/answer/2795983?hl=en
https://nodejs.org/api/http.html#http_message_headers	http://url.spec.whatwg.org/#urlutils
https://bit.ly/CRA-vitals	https://clients2.google.com/service/update2/crx
https://www.robotstxt.org/robotstxt.html	https://stackoverflow.com/questions/67806779/im-getting-an-error-tabs-cannot-be-edited-right-now-user-may-be-dragging-a-ta

Raw Manifest

{
  "name": "Ethiq",
  "icons": {
    "16": "img/icon-16.png",
    "48": "img/icon-48.png",
    "128": "img/icon-128.png"
  },
  "version": "0.1.9",
  "background": {
    "scripts": [
      "background.bundle.js"
    ]
  },
  "short_name": "Ethiq",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Ethiq",
  "permissions": [
    "storage",
    "unlimitedStorage"
  ],
  "options_page": "options.html",
  "browser_action": {
    "default_popup": "popup.html",
    "default_title": "Ethiq"
  },
  "content_scripts": [
    {
      "js": [
        "contentScript.bundle.js"
      ],
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "manifest_version": 2,
  "content_security_policy": "script-src 'self' https://*.google-analytics.com; object-src 'self'",
  "browser_specific_settings": {
    "edge": {
      "browser_action_next_to_addressbar": true
    },
    "gecko": {
      "id": "info@ethiq.org"
    }
  }
}

by ✦ Astarte

Ethiq

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (48 total):

Raw Manifest

Detections

Manifest Findings