[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

IntelligenceBank Assets Connector

Version 1.7.62 View in Chrome Web Store

Last scanned: about 11 hours ago

Extension Details

Developer: IntelligenceBank Pty Ltd

Rating: 5.0 ★ (2 ratings)

Users: 307

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors:

The extension is developed by IntelligenceBank Pty Ltd, which appears to be a legitimate company offering digital asset management services. However, the extremely low user base of only 307 users and minimal rating data (only 2 reviews) provide limited validation of the extension's trustworthiness. The 5.0 rating is positive but based on insufficient feedback to be meaningful.

Concerns:

The extension requests downloads permissions that allow it to manage files and access download history, which could be exploited for malicious purposes. The broad host permissions extending beyond just IntelligenceBank domains raise red flags, as the CSP allows connections to any HTTPS site. While the host permissions are technically scoped to IntelligenceBank domains, the combination of download capabilities and storage permissions creates potential attack vectors for data exfiltration or unauthorized file manipulation.

Recommendations:

Given the high-risk classification, consider running this extension in a separate Chrome profile to isolate it from your primary browsing activities. Only install if you specifically need IntelligenceBank asset management functionality and trust the company with your download activities. Monitor the extension's behavior closely and review what files it accesses. Consider whether the business benefits justify the security risks, and explore alternative solutions if available.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Access to Sensitive Domains

This extension requests access to sensitive domains: *://*.intelligencebank.com/*, https://cdn.intelligencebank.com/*. Ensure you trust this extension with access to these sites.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

downloads
downloads.open
downloads.shelf
storage
sidePanel

Host Permissions:

*://*.intelligencebank.com/*
https://cdn.intelligencebank.com/*

Content Security Policy:

extension_pages: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*; font-src 'self'; connect-src https://* wss://*; frame-src 'self';

Embedded URLs (97 total):

https://agent.pendo.io/licenses	https://clients2.google.com/service/update2/crx
https://www.intelligencebank.com	https://cdn.intelligencebank.com/
http://www.w3.org/2000/svg	http://help.pendo.io/resources/support-library/installation/metadata.html
https://www.pendo.io/pendo-free/nps?utm_source=pendo_app&utm_medium=branded-nps&utm_campaign=free-branded-nps	https://www.npmjs.com/package/@pendo/agent#manifest-v3-extensions
https://app.au.pendo.io	https://app.eu.pendo.io
https://app.gov.pendo.io	https://app.hsbc.pendo.io
https://app.pendo.io	https://app.jpn.pendo.io
https://react.dev/errors/	http://www.w3.org/1998/Math/MathML
http://www.w3.org/1999/xlink	http://www.w3.org/XML/1998/namespace
https://github.com/mobxjs/mobx/blob/main/packages/mobx/src/errors.ts	https://cdn.pendo.io/agent/static/493e952f-bd89-4f3d-a528-315c4bca27fa/pendo.js
https://cdn.intelligencebank.com/au/share/jD3wDg/JYOMDg/lXnPMW/original/connectingib_default_logo	https://help.intelligencebank.com
https://help.intelligencebank.com/support/solutions/articles/51000504746-share-embed-public-cdn-links	https://intelligencebank-proxy.herokuapp.com
https://vuejs.org/error-reference/#runtime-	https://v3-migration.vuejs.org/breaking-changes/global-api.html#mounting-app-instance
https://v3-migration.vuejs.org/breaking-changes/mount-changes.html	https://vuejs.org/api/general.html#definecomponent
https://v3-migration.vuejs.org/breaking-changes/global-api.html#vue-prototype-replaced-by-config-globalproperties	https://vuejs.org/api/reactivity-core.html#reactive
https://github.com/vuejs/core/tree/main/packages/vue#bundler-build-feature-flags	https://v3-migration.vuejs.org/breaking-changes/keycode-modifiers.html
https://v3-migration.vuejs.org/breaking-changes/global-api.html#config-productiontip-removed	https://v3-migration.vuejs.org/breaking-changes/global-api.html#config-ignoredelements-is-now-config-iscustomelement
https://vuejs.org/api/application.html#app-unmount	https://v3-migration.vuejs.org/breaking-changes/events-api.html
https://v3-migration.vuejs.org/breaking-changes/vnode-lifecycle-events.html	https://v3-migration.vuejs.org/breaking-changes/children.html
https://v3-migration.vuejs.org/breaking-changes/listeners-removed.html	https://v3-migration.vuejs.org/breaking-changes/slots-unification.html
https://v3-migration.vuejs.org/breaking-changes/attrs-includes-class-style.html	https://v3-migration.vuejs.org/breaking-changes/data-option.html
https://v3-migration.vuejs.org/breaking-changes/data-option.html#mixin-merge-behavior-change	https://v3-migration.vuejs.org/breaking-changes/watch.html
https://v3-migration.vuejs.org/breaking-changes/props-default-this.html	https://v3-migration.vuejs.org/breaking-changes/custom-directives.html
https://v3-migration.vuejs.org/breaking-changes/attribute-coercion.html	https://v3-migration.vuejs.org/breaking-changes/transition-group.html
https://v3-migration.vuejs.org/breaking-changes/async-components.html	https://v3-migration.vuejs.org/breaking-changes/functional-components.html
https://v3-migration.vuejs.org/breaking-changes/v-model.html	https://v3-migration.vuejs.org/breaking-changes/render-function-api.html
https://v3-migration.vuejs.org/breaking-changes/filters.html	https://vuejs.org/error-reference/#compiler-
https://v3-migration.vuejs.org/breaking-changes/custom-elements-interop.html	https://v3-migration.vuejs.org/breaking-changes/v-bind.html
https://v3-migration.vuejs.org/breaking-changes/v-on-native-modifier-removed.html	https://v3-migration.vuejs.org/breaking-changes/v-if-v-for.html
https://v3-migration.vuejs.org/breaking-changes/inline-template-attribute.html	https://next.vuex.vuejs.org/
https://vuejs.org/images/icons/favicon-96x96.png	http://www.w3.org/1999/xhtml
https://cdn.pendo.io/fonts/sora-light/sora-light.woff2	https://cdn.pendo.io/fonts/sora-regular/sora-regular.woff2
https://cdn.pendo.io/fonts/sora-semibold/sora-semibold.woff2	https://cdn.pendo.io/fonts/sora-bold/sora-bold.woff2
https://cdn.pendo.io/fonts/sora-extrabold/sora-extrabold.woff2	https://cdn.pendo.io/fonts/inter-light/inter-light.woff2
https://cdn.pendo.io/fonts/inter-light/inter-light.woff	https://cdn.pendo.io/fonts/inter-lightit/inter-lightit.woff2
https://cdn.pendo.io/fonts/inter-lightit/inter-lightit.woff	https://cdn.pendo.io/fonts/inter-regular/inter-regular.woff2
https://cdn.pendo.io/fonts/inter-regular/inter-regular.woff	https://cdn.pendo.io/fonts/inter-regularit/inter-regularit.woff2
https://cdn.pendo.io/fonts/inter-regularit/inter-regularit.woff	https://cdn.pendo.io/fonts/inter-medium/inter-medium.woff2
https://cdn.pendo.io/fonts/inter-medium/inter-medium.woff	https://cdn.pendo.io/fonts/inter-mediumit/inter-mediumit.woff2
https://cdn.pendo.io/fonts/inter-mediumit/inter-mediumit.woff	https://cdn.pendo.io/fonts/inter-semibold/inter-semibold.woff2

Page 1 of 2

Raw Manifest

{
  "name": "IntelligenceBank Assets Connector",
  "icons": {
    "16": "images/icon-16.png",
    "32": "images/icon-32.png",
    "48": "images/icon-48.png",
    "96": "images/icon-96.png"
  },
  "action": {
    "default_icon": {
      "19": "images/icon-19.png",
      "38": "images/icon-76.png"
    },
    "default_title": "IntelligenceBank Assets Connector"
  },
  "version": "1.7.62",
  "background": {
    "type": "module",
    "service_worker": "service-worker-loader.js"
  },
  "side_panel": {
    "default_path": "index.html?app=&mode=sidepanel"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Get more approved content to market faster with the IntelligenceBank Assets Connector.",
  "permissions": [
    "downloads",
    "downloads.open",
    "downloads.shelf",
    "storage",
    "sidePanel"
  ],
  "homepage_url": "https://www.intelligencebank.com",
  "host_permissions": [
    "*://*.intelligencebank.com/*",
    "https://cdn.intelligencebank.com/*"
  ],
  "manifest_version": 3,
  "content_security_policy": {
    "extension_pages": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*; font-src 'self'; connect-src https://* wss://*; frame-src 'self';"
  },
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "debugger-plugin.min.js",
        "pendo.debugger.min.js",
        "pendo.preview.min.js",
        "replay.worker.min.js",
        "guide.css"
      ],
      "use_dynamic_url": false
    }
  ]
}

by ✦ Astarte

IntelligenceBank Assets Connector

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (97 total):

Raw Manifest

Detections

Manifest Findings