[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

BBCRM Sherpa

Version 1.2.0 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Rating: 5.0 ★ (1 rating)

Users: 18

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: The extension has very limited adoption with only 18 users and a single 5-star rating, which provides insufficient data to establish trustworthiness. The lack of developer information, company details, and update history raises transparency concerns. The name "BBCRM Sherpa" suggests it's related to CRM functionality, but without a clear description, its actual purpose remains unclear.

Concerns: The history permission is particularly concerning given the extension's unclear purpose and minimal user base. Access to browsing history is a sensitive permission that could expose personal browsing patterns, visited websites, and potentially confidential information. The storage permission, while less critical, allows data persistence which could be used to collect and retain user information. The combination of these permissions with the lack of transparency about the developer and extension functionality creates potential privacy risks.

Recommendations: Given the medium risk level and unclear legitimacy, consider running this extension in a separate Chrome profile to isolate potential risks from your main browsing environment. Before installation, try to verify the extension's actual purpose and developer credentials. Monitor the extension's behavior closely and consider whether the CRM functionality it presumably provides is worth the privacy trade-offs. If possible, look for alternative CRM extensions from more established developers with better transparency and user adoption rates.

Findings

HIGH

High-Risk Permission: history

This extension has the history permission. Can access your browsing history. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

history
storage

Embedded URLs (79 total):

https://phsqaatlas02.partners.org/bbAppFx/appfxwebservice.asmx	http://www.w3.org/2001/XMLSchema-instance
http://www.w3.org/2001/XMLSchema	http://www.w3.org/2003/05/soap-envelope
https://clients2.google.com/service/update2/crx	https://getbootstrap.com/
https://github.com/twbs/bootstrap/blob/master/LICENSE	https://www.w3.org/TR/mediaqueries-4/#mq-min-max
https://bugs.webkit.org/show_bug.cgi?id=178261	http://www.w3.org/2000/svg
https://github.com/necolas/normalize.css/blob/master/LICENSE.md	https://github.com/necolas/normalize.css
https://github.com/suitcss/base	https://github.com/twbs/bootstrap/issues/19402
https://github.com/twbs/bootstrap/issues/26878	https://github.com/twbs/bootstrap/issues/24093
https://github.com/suitcss/base/	https://bugs.webkit.org/show_bug.cgi?id=139848
https://github.com/twbs/bootstrap/issues/11266	https://github.com/twbs/bootstrap/issues/12359
https://html.spec.whatwg.org/multipage/#the-fieldset-and-legend-elements	https://github.com/twbs/bootstrap/issues/11586.
https://github.com/twbs/bootstrap/issues/25195	https://github.com/sass/sass/issues/2383#issuecomment-336349172
https://github.com/twbs/bootstrap/issues/18178	https://caniuse.com/#feat=css-media-resolution
https://github.com/twbs/bootstrap/pull/10057	https://github.com/twbs/bootstrap/pull/11526.
https://github.com/twbs/bootstrap/issues/11655.	https://github.com/twbs/bootstrap/issues/19398.
https://github.com/twbs/bootstrap/pull/12794	https://github.com/twbs/bootstrap/pull/14559
https://useiconic.com/open	https://primer.github.io/.
https://github.com/philipwalton/flexbugs#flexbug-4	https://developer.mozilla.org/en-US/docs/Web/Events/click#Safari_Mobile
https://github.com/twbs/bootstrap/pull/10951.	https://bugs.webkit.org/show_bug.cgi?id=158342
https://github.com/twbs/bootstrap/issues/17695	https://a11yproject.com/posts/how-to-hide-content/
https://hugogiraudel.com/2016/10/13/css-hide-and-seek/	https://www.w3.org/TR/2013/NOTE-WCAG20-TECHS-20130905/G1
https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css	https://www.phpied.com/delay-loading-your-print-css/
http://css-discuss.incutio.com/wiki/Printing_Tables	https://github.com/twbs/bootstrap/graphs/contributors
https://goo.gl/pxwQGp	https://github.com/FezVrasta/popper.js/pull/715
https://github.com/FezVrasta/popper.js/issues/373	https://popper.js.org
https://popper.js.org/	https://github.com/twbs/bootstrap/issues/24251
https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html	https://github.com/flaute/bootstrap-colorselector
https://github.com/tkrotoff/jquery-simplecolorpicker	https://github.com/twbs/bootstrap/blob/master/less/navbar.less
https://github.com/twbs/bootstrap/blob/master/less/dropdowns.less	https://fontawesome.com
https://fontawesome.com/license/free	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
http://jqueryui.com	http://jqueryui.com/themeroller/?bgShadowXPos=&bgOverlayXPos=&bgErrorXPos=&bgHighlightXPos=&bgContentXPos=&bgHeaderXPos=&bgActiveXPos=&bgHoverXPos=&bgDefaultXPos=&bgShadowYPos=&bgOverlayYPos=&bgErrorYPos=&bgHighlightYPos=&bgContentYPos=&bgHeaderYPos=&bgActiveYPos=&bgHoverYPos=&bgDefaultYPos=&bgShadowRepeat=&bgOverlayRepeat=&bgErrorRepeat=&bgHighlightRepeat=&bgContentRepeat=&bgHeaderRepeat=&bgActiveRepeat=&bgHoverRepeat=&bgDefaultRepeat=&iconsHover=url
https://github.com/jdorn/json-editor/issues/800	https://github.com/jdorn/json-editor/
https://github.com/json-editor/json-editor	http://ejohn.org/
https://github.com/szimek/signature_pad	https://github.com/szimek
https://jsperf.com/innerhtml-vs-removechild/37	http://materializecss.com/grid.html
http://materializecss.com/buttons.html	http://materializecss.com/forms.html
https://github.com/Dogfalo/materialize/issues/2542#issuecomment-233458602	http://materializecss.com/forms.html#select
http://materializecss.com/forms.html#textarea	http://materializecss.com/cards.html
https://stackoverflow.com/a/2117523	http://materializecss.com/icons.html
http://opensource.org/licenses/MIT

Raw Manifest

{
  "name": "BBCRM Sherpa",
  "icons": {
    "128": "img/icon_128.png"
  },
  "action": {
    "default_icon": "img/icon.png",
    "default_popup": "popup.html"
  },
  "version": "1.2.0",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "BBCRM Sherpa.  This extension organizes your CRM browser history.",
  "permissions": [
    "history",
    "storage"
  ],
  "manifest_version": 3
}

by ✦ Astarte