[ new scan ] [ statistics ] [ github ] [ twitter ]

Patreon Downloader

Version 1.1.3 View in Chrome Web Store

Last scanned: about 1 month ago | force re-scan

Extension Details

Rating: 2.9 ★ (133 ratings)

Size: 348KiB

Last Updated: October 6, 2023

Users: 40,000

Context-Aware Verdict

MEDIUM

Risk Level

Trust Factors:

- The extension has a relatively high number of users (40,000), which suggests some level of trust and popularity.

- However, the lack of developer information and a low rating (2.9/5) raise some concerns about the trustworthiness of the extension.

Concerns:

- The extension requests the "tabs" permission, which is considered a high-risk permission as it can potentially be used to compromise security or privacy by accessing and manipulating browser tabs.

- The "unlimitedStorage" permission allows the extension to store an unlimited amount of data locally, which could be a privacy concern if sensitive data is stored.

- The content scripts have access to all Patreon posts, which could potentially be used to scrape or modify content without the user's consent.

Recommendations:

- Exercise caution when using this extension, as it has access to sensitive information and permissions that could potentially be misused.

- Consider running the extension in a separate browser profile or a sandboxed environment to mitigate potential risks.

- Monitor the extension's behavior and check for any suspicious activities, such as unexpected data transfers or modifications to Patreon content.

- Keep an eye on updates and reviews of the extension, and uninstall it if any major security concerns arise.

- As an alternative, consider using official Patreon tools or other reputable extensions for downloading Patreon content, if available.

Security Analysis

MEDIUM

Overall Risk

Based on 4 total findings, ranked without considering overall context, including 1 high-risk and 3 medium-risk findings.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

storage
tabs
activeTab
unlimitedStorage

Embedded URLs (73 total):

https://raw.githubusercontent.com/sneat/patreon-downloader/main/screenshot/screenshot.png	https://chrome.google.com/webstore/detail/patreon-downloader/mnfjhjpninhcccbahcdbcphpifofoajc?hl=en-GB
https://github.com/sneat/patreon-downloader/releases/	https://discord.gg/NQkFhnxcqC
https://github.com/sneat/patreon-downloader/issues	https://clients2.google.com/service/update2/crx
https://www.patreon.com/posts/	https://patreon.com/posts/
https://www.patreon.com/	https://patreon.com/
https://chrome.google.com/webstore/detail/live-stream-downloader/looepbdllpjgdmkpdcdffhdbmpbcfekj	https://stackoverflow.com/a/18637230/191306
https://getbootstrap.com/	https://github.com/twbs/bootstrap/blob/main/LICENSE
https://github.com/sass/sass/issues/2383#issuecomment-336349172	https://github.com/necolas/normalize.css
https://github.com/twbs/bootstrap/issues/19402	https://github.com/twbs/bootstrap/issues/24093
https://github.com/twbs/bootstrap/pull/30562	https://github.com/twbs/bootstrap/issues/24990
https://stackoverflow.com/a/54997118	https://github.com/twbs/bootstrap/issues/12359
https://html.spec.whatwg.org/multipage/#the-fieldset-and-legend-elements	https://github.com/twbs/bootstrap/issues/29712
https://github.com/twbs/bootstrap/issues/18842	https://github.com/twbs/bootstrap/issues/11586.
https://rtlstyling.com/posts/rtl-styling#form-inputs	https://rtlcss.com/learn/usage-guide/control-directives/#raw
http://www.w3.org/2000/svg	https://github.com/twbs/rfs/blob/master/LICENSE
https://github.com/twbs/rfs/issues/14	https://github.com/twbs/bootstrap/issues/18178
https://www.w3.org/TR/mediaqueries-4/#mq-min-max	https://bugs.webkit.org/show_bug.cgi?id=178261
https://github.com/philipwalton/flexbugs#flexbug-4	https://github.com/twbs/bootstrap/issues/23307
https://bugs.webkit.org/show_bug.cgi?id=198959	https://github.com/twbs/bootstrap/pull/11526.
https://github.com/twbs/bootstrap/issues/11655.	https://github.com/twbs/bootstrap/pull/29124
https://primer.github.io/.	https://github.com/twbs/bootstrap/issues/28247
https://stackoverflow.com/questions/36247140/why-dont-flex-items-shrink-past-content-size	https://github.com/sass/sass/issues/1873#issuecomment-152293725
https://github.com/twbs/bootstrap/pull/27703	https://github.com/twbs/bootstrap/pull/22740#issuecomment-305868106
https://developer.mozilla.org/en-US/docs/Web/Events/click#Safari_Mobile	https://github.com/twbs/bootstrap/pull/10951.
https://bugs.webkit.org/show_bug.cgi?id=158342	https://github.com/twbs/bootstrap/issues/17695
https://github.com/twbs/bootstrap/issues/24800	https://www.a11yproject.com/posts/2013-01-11-how-to-hide-content/
https://hugogiraudel.com/2016/10/13/css-hide-and-seek/	https://github.com/twbs/bootstrap/issues/25686
https://www.w3.org/TR/2013/NOTE-WCAG20-TECHS-20130905/G1	https://github.com/twbs/bootstrap/graphs/contributors
https://popper.js.org	https://goo.gl/pxwQGp
https://github.com/twbs/bootstrap/issues/32273	https://github.com/popperjs/popper-core/issues/1223
https://github.com/popperjs/popper-core/issues/837	https://developer.mozilla.org/en-US/docs/Web/CSS/Containing_block#identifying_the_containing_block
https://github.com/facebook/flow/issues/1414	https://github.com/popperjs/popper-core/issues/1078
https://stackoverflow.com/questions/49875255	https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
https://developer.mozilla.org/en-US/docs/Web/API/Window/innerWidth#usage_notes	https://github.com/twbs/bootstrap/blob/master/LICENSE
https://github.com/angular/angular/blob/7.2.4/packages/core/src/sanitization/url_sanitizer.ts	https://stackoverflow.com/a/14919494/191306
https://github.com/101arrowz/fflate	https://developer.mozilla.org/en-US/docs/Web/API/File
https://developer.mozilla.org/en-US/docs/Web/API/Blob

Raw Manifest

{
  "name": "Patreon Downloader",
  "icons": {
    "16": "/icons/icon-16x16.png",
    "32": "/icons/icon-32x32.png",
    "48": "/icons/icon-48x48.png",
    "128": "/icons/icon-128x128.png"
  },
  "action": {
    "default_icon": {
      "16": "/icons/icon-16x16.png",
      "32": "/icons/icon-32x32.png",
      "48": "/icons/icon-48x48.png",
      "128": "/icons/icon-128x128.png"
    },
    "default_popup": "src/popup.html",
    "default_title": "Patreon Downloader"
  },
  "version": "1.1.3",
  "background": {
    "service_worker": "src/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Download media and attachments from Patreon pages.",
  "permissions": [
    "storage",
    "tabs",
    "activeTab",
    "unlimitedStorage"
  ],
  "content_scripts": [
    {
      "js": [
        "src/contentScript.js",
        "src/js/downloader.js",
        "src/fflate/fflate.js",
        "src/js/compressor.js"
      ],
      "matches": [
        "https://www.patreon.com/posts/*",
        "https://patreon.com/posts/*"
      ]
    }
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "https://www.patreon.com/*",
        "https://patreon.com/*"
      ],
      "resources": [
        "src/patreon-downloader.js"
      ]
    }
  ]
}

Patreon Downloader

Extension Details

Context-Aware Verdict

Security Analysis

Security Analysis Details

Required Permissions:

Embedded URLs (73 total):

Raw Manifest

Secure Annex (beta)