[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Devtools for Tailwind CSS

Version 1.1.1 View in Chrome Web Store

Last scanned: about 12 hours ago

Extension Details

Developer: Beyond Code GmbH

Rating: 2.5 ★ (18 ratings)

Users: 1,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 5 total findings, including 2 high-risk findings.

Findings

HIGH

High-Risk Permission: <all_urls>

This extension has the <all_urls> permission. Can access all websites and their content. This could potentially be used maliciously to compromise security or privacy.

HIGH

Unsafe JavaScript Evaluation

This extension's Content Security Policy allows 'unsafe-eval', which permits dynamic JavaScript code execution using eval() and similar functions. This is a significant security risk as it could allow execution of malicious code.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Older Manifest Version

This extension uses Manifest Version 2, which has fewer security restrictions than Manifest V3. Consider using extensions that have upgraded to V3.

Security Analysis Details

Required Permissions:

activeTab
storage
<all_urls>

Content Security Policy:

script-src 'unsafe-eval' https://cdn.skypack.dev 'self' 'sha256-NJiKRI/il+u/mGckB8g7UIbJf8ZRdAn2uEtCntnB/wY=' 'sha256-RVKUWnr5wnb+fbxDRLVzpSEw858PlpwgLBqCH2BjLWE=' 'sha256-COOKcJGlnGybrT6EcBXfr3L4yYOiLk84sQ77apt+RxM=' 'sha256-7bCPP/PcnX5Jp2kNdr1sCRfIztDxzrt2IzxxCoRTrTA=' 'sha256-SLBhcuh3zXgRE5rg89fqMiRSqsuke2Gd5SzhYbXvF2g=' 'sha256-/6gew8oNosZTVpovZx0W55fYTb8tK2+fUOYFy0lQ8/M='; object-src 'self'

Embedded URLs (993 total):

http://www.w3.org/2000/svg	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage
https://api.beyondco.de/api/licenses	https://fonts.googleapis.com/css2?family=Inter:wght@400
https://usetw-dev.com	https://clients2.google.com/service/update2/crx
https://devtoolsfortailwind.com	https://cdn.skypack.dev
https://tailwindcss.com	https://github.com/sindresorhus/modern-normalize
https://code.visualstudio.com/docs/editor/codebasics#_multicursor-modifier	https://github.com/markedjs/marked.
https://github.com/Microsoft/monaco-editor#faq	http://www.w3.org/1999/xhtml
https://developer.mozilla.org/en-US/docs/Web/CSS/Specificity	https://sass-lang.com/documentation/at-rules/use
https://sass-lang.com/documentation/at-rules/forward	https://sass-lang.com/documentation/modules/math
https://sass-lang.com/documentation/modules/string	https://sass-lang.com/documentation/modules/color
https://sass-lang.com/documentation/modules/list	https://sass-lang.com/documentation/modules/map
https://sass-lang.com/documentation/modules/selector	https://sass-lang.com/documentation/modules/meta
https://go.microsoft.com/fwlink/?linkid=852450	https://github.com/Microsoft/monaco-editor
https://evilmartians.com/chronicles/postcss-8-plugin-migration	https://www.w3ctech.com/topic/2226
https://github.com/tailwindlabs/tailwindcss.git	https://github.com/tailwindlabs/tailwindcss/issues
https://github.com/puleos/object-hash/issues/26	http://github.com/dominictarr/crypto-browserify
https://github.com/mozdevs/cssremedy/issues/4	https://github.com/tailwindcss/tailwindcss/pull/116
https://bugzilla.mozilla.org/show_bug.cgi?id=190655	https://bugs.chromium.org/p/chromium/issues/detail?id=999088
https://bugs.webkit.org/show_bug.cgi?id=201297	https://bugs.chromium.org/p/chromium/issues/detail?id=935729
https://bugs.webkit.org/show_bug.cgi?id=195016	https://github.com/mozilla/gecko-dev/blob/2f9eacd9d3d995c937b4251a5557d95d494c9be1/layout/style/res/forms.css#L728-L737
https://github.com/tailwindlabs/tailwindcss/issues/3300	https://github.com/mozdevs/cssremedy/issues/14
https://github.com/jensimmons/cssremedy/issues/14#issuecomment-634934210	https://tailwindcss.com/docs/configuration#prefix
https://tailwindcss.com/docs/configuration#selector-strategy	https://tailwindcss.com/docs/using-with-preprocessors#nesting
https://tailwindcss.com/docs/just-in-time-mode#watch-mode-and-one-off-builds	https://tailwindcss-v0.netlify.app/docs/
https://v1.tailwindcss.com/docs/	https://tailwindcss.com/docs/
https://unpkg.com/shimport@2.0.4/index.js	https://cdn.skypack.dev/
https://github.com/browserslist/browserslist#readme	https://twitter.com/browserslist
https://github.com/postcss/autoprefixer#readme	https://github.com/postcss/postcss/wiki/PostCSS-8-for-end-users
https://err.sh/vercel/next.js/	https://www.w3.org/TR/html5/syntax.html#closing-elements-that-have-implied-end-tags
https://npms.io/search?q=ponyfill.	https://developer.mozilla.org/en-US/docs/Web/HTML/Using_the_application_cache
https://developer.mozilla.org/en-US/docs/Glossary/DTD	https://developer.mozilla.org/docs/Web/HTML/Element/html
https://developer.mozilla.org/docs/Web/HTML/Element/head	https://developer.mozilla.org/docs/Web/HTML/Element/title
https://developer.mozilla.org/docs/Web/HTML/Element/base	https://developer.mozilla.org/en-US/docs/Glossary/URL
https://developer.mozilla.org/en-US/docs/Glossary/CORS	https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_Enabled_Image
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/canvas	https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin	https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_settings_attributes	https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types
https://developer.mozilla.org/en-US/docs/Web/CSS/Media_queries	https://developer.mozilla.org/en-US/docs/Web/CSS/@media
https://www.ietf.org/rfc/bcp/bcp47.txt	https://developer.mozilla.org/en-US/docs/Web/HTML/Element/a#attr-href
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/link#attr-rel	https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes#attr-sizes

Page 1 of 13

Raw Manifest

{
  "name": "__MSG_extName__",
  "icons": {
    "16": "icons/16.png",
    "48": "icons/48.png",
    "128": "icons/128.png"
  },
  "version": "1.1.1",
  "background": {
    "scripts": [
      "js/background.js"
    ],
    "persistent": false
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Devtools for Tailwind CSS",
  "permissions": [
    "activeTab",
    "storage",
    "<all_urls>"
  ],
  "homepage_url": "https://devtoolsfortailwind.com",
  "devtools_page": "./panel.html",
  "browser_action": {
    "default_icon": {
      "19": "icons/19.png",
      "38": "icons/38.png"
    },
    "default_title": "__MSG_extName__"
  },
  "default_locale": "en",
  "manifest_version": 2,
  "content_security_policy": "script-src 'unsafe-eval' https://cdn.skypack.dev 'self'  'sha256-NJiKRI/il+u/mGckB8g7UIbJf8ZRdAn2uEtCntnB/wY=' 'sha256-RVKUWnr5wnb+fbxDRLVzpSEw858PlpwgLBqCH2BjLWE=' 'sha256-COOKcJGlnGybrT6EcBXfr3L4yYOiLk84sQ77apt+RxM=' 'sha256-7bCPP/PcnX5Jp2kNdr1sCRfIztDxzrt2IzxxCoRTrTA=' 'sha256-SLBhcuh3zXgRE5rg89fqMiRSqsuke2Gd5SzhYbXvF2g=' 'sha256-/6gew8oNosZTVpovZx0W55fYTb8tK2+fUOYFy0lQ8/M='; object-src 'self'"
}

by ✦ Astarte

Devtools for Tailwind CSS

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Content Security Policy:

Embedded URLs (993 total):

Raw Manifest

Detections

Manifest Findings