[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Patreon Downloader

Version 1.2.2 View in Chrome Web Store

Last scanned: about 1 hour ago

Extension Details

Rating: 2.8 ★ (201 ratings)

Users: 60,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a concerning trust profile with only 60,000 users and a poor 2.8-star rating from 201 reviews, suggesting user dissatisfaction. The lack of clear developer information raises transparency concerns. The name "Patreon Downloader" implies functionality for downloading content from Patreon, which may involve copyright-sensitive material.

Concerns: The tabs permission is particularly concerning as it allows broad access to browser tab information and manipulation capabilities that far exceed what's needed for a simple downloader. The combination of unlimitedStorage with tabs access creates potential for extensive data collection and storage. Content scripts running on Patreon domains could intercept sensitive user data including payment information, personal messages, and creator content. The poor user rating suggests the extension may not function as advertised or may exhibit problematic behavior.

Recommendations: Given the high risk level, run this extension in a separate Chrome profile isolated from your main browsing activities. Avoid using it while logged into sensitive accounts or when accessing financial information. Consider the legal implications of downloading copyrighted content from Patreon. Monitor your browser's performance and data usage when the extension is active. Given the poor ratings and broad permissions, consider seeking alternative solutions for Patreon content management that have better security practices and user reviews.

Findings

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
tabs
activeTab
unlimitedStorage

Embedded URLs (72 total):

https://raw.githubusercontent.com/sneat/patreon-downloader/main/screenshot/screenshot.png	https://chrome.google.com/webstore/detail/patreon-downloader/mnfjhjpninhcccbahcdbcphpifofoajc?hl=en-GB
https://github.com/sneat/patreon-downloader/releases/	https://discord.gg/NQkFhnxcqC
https://github.com/sneat/patreon-downloader/issues	https://clients2.google.com/service/update2/crx
https://www.patreon.com/	https://patreon.com/
https://stackoverflow.com/a/14919494/191306	https://github.com/101arrowz/fflate
https://developer.mozilla.org/en-US/docs/Web/API/File	https://developer.mozilla.org/en-US/docs/Web/API/Blob
https://github.com/twbs/bootstrap/blob/main/LICENSE	https://goo.gl/pxwQGp
https://github.com/twbs/bootstrap/issues/32273	https://github.com/popperjs/popper-core/issues/1223
https://github.com/popperjs/popper-core/issues/837	https://developer.mozilla.org/en-US/docs/Web/CSS/Containing_block#identifying_the_containing_block
https://github.com/facebook/flow/issues/1414	https://github.com/popperjs/popper-core/issues/1078
https://stackoverflow.com/questions/49875255	https://popper.js.org
https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html	https://developer.mozilla.org/en-US/docs/Web/API/Window/innerWidth#usage_notes
https://github.com/twbs/bootstrap/blob/master/LICENSE	https://github.com/angular/angular/blob/7.2.4/packages/core/src/sanitization/url_sanitizer.ts
https://getbootstrap.com/	https://github.com/twbs/bootstrap/graphs/contributors
https://github.com/sass/sass/issues/2383#issuecomment-336349172	https://github.com/necolas/normalize.css
https://github.com/twbs/bootstrap/issues/19402	https://github.com/twbs/bootstrap/issues/24093
https://github.com/twbs/bootstrap/pull/30562	https://github.com/twbs/bootstrap/issues/24990
https://stackoverflow.com/a/54997118	https://github.com/twbs/bootstrap/issues/12359
https://html.spec.whatwg.org/multipage/#the-fieldset-and-legend-elements	https://github.com/twbs/bootstrap/issues/29712
https://github.com/twbs/bootstrap/issues/18842	https://github.com/twbs/bootstrap/issues/11586.
https://rtlstyling.com/posts/rtl-styling#form-inputs	https://rtlcss.com/learn/usage-guide/control-directives/#raw
http://www.w3.org/2000/svg	https://github.com/twbs/rfs/blob/master/LICENSE
https://github.com/twbs/rfs/issues/14	https://github.com/twbs/bootstrap/issues/18178
https://www.w3.org/TR/mediaqueries-4/#mq-min-max	https://bugs.webkit.org/show_bug.cgi?id=178261
https://github.com/philipwalton/flexbugs#flexbug-4	https://github.com/twbs/bootstrap/issues/23307
https://bugs.webkit.org/show_bug.cgi?id=198959	https://github.com/twbs/bootstrap/pull/11526.
https://github.com/twbs/bootstrap/issues/11655.	https://github.com/twbs/bootstrap/pull/29124
https://primer.github.io/.	https://github.com/twbs/bootstrap/issues/28247
https://stackoverflow.com/questions/36247140/why-dont-flex-items-shrink-past-content-size	https://github.com/sass/sass/issues/1873#issuecomment-152293725
https://github.com/twbs/bootstrap/pull/27703	https://github.com/twbs/bootstrap/pull/22740#issuecomment-305868106
https://developer.mozilla.org/en-US/docs/Web/Events/click#Safari_Mobile	https://github.com/twbs/bootstrap/pull/10951.
https://bugs.webkit.org/show_bug.cgi?id=158342	https://github.com/twbs/bootstrap/issues/17695
https://github.com/twbs/bootstrap/issues/24800	https://www.a11yproject.com/posts/2013-01-11-how-to-hide-content/
https://hugogiraudel.com/2016/10/13/css-hide-and-seek/	https://github.com/twbs/bootstrap/issues/25686
https://www.w3.org/TR/2013/NOTE-WCAG20-TECHS-20130905/G1	https://www.patreon.com/api/posts/
https://stackoverflow.com/a/18637230/191306	https://chrome.google.com/webstore/detail/live-stream-downloader/looepbdllpjgdmkpdcdffhdbmpbcfekj

Raw Manifest

{
  "name": "Patreon Downloader",
  "icons": {
    "16": "/icons/icon-16x16.png",
    "32": "/icons/icon-32x32.png",
    "48": "/icons/icon-48x48.png",
    "128": "/icons/icon-128x128.png"
  },
  "action": {
    "default_icon": {
      "16": "/icons/icon-16x16.png",
      "32": "/icons/icon-32x32.png",
      "48": "/icons/icon-48x48.png",
      "128": "/icons/icon-128x128.png"
    },
    "default_popup": "src/popup.html",
    "default_title": "Patreon Downloader"
  },
  "version": "1.2.2",
  "background": {
    "service_worker": "src/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Download media and attachments from Patreon pages.",
  "permissions": [
    "storage",
    "tabs",
    "activeTab",
    "unlimitedStorage"
  ],
  "content_scripts": [
    {
      "js": [
        "src/contentScript.js",
        "src/js/downloader.js",
        "src/fflate/fflate.js",
        "src/js/compressor.js"
      ],
      "run_at": "document_idle",
      "matches": [
        "https://www.patreon.com/*",
        "https://patreon.com/*"
      ]
    }
  ],
  "manifest_version": 3
}

by ✦ Astarte

Patreon Downloader

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (72 total):

Raw Manifest

Detections

Manifest Findings