[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Transpose by Chordify

Version 0.5 View in Chrome Web Store

Last scanned: about 3 hours ago

Extension Details

Developer: Chordify B.V.

Rating: 3.4 ★ (21 ratings)

Users: 4,000

Context-Aware Verdict

LOW

Overall Risk

Trust Factors:

The extension is developed by Chordify B.V., a legitimate company known for music chord analysis services. The extension directly relates to their core business of providing chord charts for songs. However, the relatively small user base of 4,000 users and moderate rating of 3.4 out of 5 stars suggest limited adoption and mixed user satisfaction.

Concerns:

The activeTab permission, while flagged as medium-risk, is actually appropriate for this extension's functionality of transposing chords on music websites. The host permissions are well-scoped to relevant music platforms (Chordify, YouTube variants) where the extension would logically need to operate. The content script injections are targeted to specific URL patterns related to chord charts and video embeds, which aligns with the extension's purpose.

Recommendations:

This extension presents minimal security risk given its focused scope and appropriate permissions. The permissions match the expected functionality for a music transposition tool. Users can safely install this extension in their main Chrome profile. However, given the moderate user rating, consider checking recent reviews for any functionality issues before installation. The extension appears to be a legitimate tool for musicians who use Chordify's services and want transposition capabilities on YouTube music videos.

Findings

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

Security Analysis Details

Required Permissions:

activeTab

Host Permissions:

https://chordify.net/
https://www.youtube.com/
https://www.youtube-nocookie.com/
https://music.youtube.com/

Embedded URLs (17 total):

https://www.npmjs.com/package/signalsmith-stretch	https://clients2.google.com/service/update2/crx
https://chordify.net/	https://www.youtube.com/
https://www.youtube-nocookie.com/	https://music.youtube.com/
https://chordify.net/chords/	https://www.youtube-nocookie.com/embed/
https://www.youtube.com/embed/	https://www.youtube.com/watch
https://chordify.net/premium	https://chordify.net/setlists/premium
https://chordify.net	https://support.chordify.net/hc/en-us
https://chromewebstore.google.com/detail/chordify-transpose-audio/mckabjbenkkimhkplcapjjhhpbkcfaha	https://chordify.net/chords/youtube:
https://developer.mozilla.org/en-US/docs/Web/API/AudioWorkletNode/AudioWorkletNode#options

Raw Manifest

{
  "name": "Transpose by Chordify",
  "icons": {
    "32": "icon-32x32.png",
    "48": "icon-48x48.png",
    "128": "icon-128x128.png"
  },
  "action": {
    "default_icon": "icon-32x32.png",
    "default_popup": "popup.html"
  },
  "version": "0.5",
  "background": {
    "service_worker": "background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Transposes the audio when using the transpose feature on Chordify. Also works on YouTube.",
  "permissions": [
    "activeTab"
  ],
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://chordify.net/chords/*"
      ]
    },
    {
      "js": [
        "SignalsmithStretch.js",
        "chordify-embed.js"
      ],
      "run_at": "document_end",
      "matches": [
        "https://www.youtube-nocookie.com/embed/*",
        "https://www.youtube.com/embed/*"
      ],
      "all_frames": true
    },
    {
      "js": [
        "SignalsmithStretch.js",
        "chordify-embed.js"
      ],
      "run_at": "document_end",
      "matches": [
        "https://www.youtube.com/watch*"
      ]
    }
  ],
  "host_permissions": [
    "https://chordify.net/",
    "https://www.youtube.com/",
    "https://www.youtube-nocookie.com/",
    "https://music.youtube.com/"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "https://chordify.net/*"
      ],
      "resources": [
        "inject-songpage.js"
      ]
    },
    {
      "matches": [
        "https://www.youtube-nocookie.com/*",
        "https://www.youtube.com/*"
      ],
      "resources": [
        "SignalsmithStretch.js",
        "inject.js"
      ]
    }
  ]
}

by ✦ Astarte