[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

ScriptCat

Version 1.3.2 View in Chrome Web Store

Last scanned: about 5 hours ago

Extension Details

Developer: docs.scriptcat.org

Rating: 4.5 ★ (70 ratings)

Users: 100,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 12 total findings, including 7 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: clipboardWrite

This extension has the clipboardWrite permission. Can modify clipboard content. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

tabs
alarms
storage
cookies
offscreen
scripting
downloads
activeTab
webRequest
userScripts
contextMenus
webNavigation
notifications
clipboardWrite
unlimitedStorage
declarativeNetRequest

Optional Permissions:

background

Host Permissions:

<all_urls>

Embedded URLs (5025 total):

https://clients2.google.com/service/update2/crx	http://fb.me/use-check-prop-types
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	https://github.com/silverwzw/Tampermonkey-Typescript-Declaration
https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest/readyState	https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API/cookies#storage_partitioning
https://discord.gg/JF76nHCCM7	https://docs.scriptcat.org
https://ext.scriptcat.org/	https://scriptcat.org/scripts/code/
https://update.greasyfork.org/scripts/	https://openuserjs.org/install/
https://scriptcat.org/api/v2/scripts/	https://crowdin.com/project/scriptcat
https://scriptcat.org/script-show-page/	https://greasyfork.org/scripts/
https://github.com/	https://not-found.scriptcat.org/
https://github.com/theKashey/focus-lock/#focus-fighting	https://tinyurl.com/y2uuvskb
http://bit.ly/2kdckMn	http://www.w3.org/1998/Math/MathML
http://www.w3.org/2000/svg	http://www.w3.org/1999/xhtml
https://yash-singh1.github.io/eslint-plugin-userscripts/#/rules/	https://stuk.github.io/jszip/documentation/howto/read_zip.html
https://microsoft.com	https://github.com/markedjs/marked.
https://github.com/microsoft/monaco-editor#faq	https://code.visualstudio.com/docs/editor/codebasics#_find-and-replace
https://code.visualstudio.com/docs/editor/codebasics#_multicursor-modifier	https://prettier.io/docs/plugins#optional-embed
https://reactjs.org/docs/error-decoder.html?invariant=	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types/Common_types
https://developer.mozilla.org/en-US/docs/Web/API/File_System_Access_API	https://reactrouter.com/en/main/routers/picking-a-router.
https://github.com/ungap/url-search-params.	http://apache.org/dav/propset/fs/1
https://github.com/perry-mitchell/webdav-client/blob/master/LOCK_CONTACT.md	http://json-schema.org/draft-07/schema#
https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json#	https://github.com/ajv-validator/ajv/blob/master/lib/definition_schema.js
http://json-schema.org/draft-07/schema	http://json-schema.org/schema
http://json-schema.org/draft-04/schema#	https://eslint.org/docs/latest/rules/accessor-pairs
https://eslint.org/blog/2023/10/deprecating-formatting-rules/	https://eslint.style/guide/migration
https://eslint.style/packages/js	https://eslint.style/rules/js/array-bracket-newline
https://eslint.org/docs/latest/rules/array-bracket-newline	https://eslint.style/rules/js/array-bracket-spacing
https://eslint.org/docs/latest/rules/array-bracket-spacing	https://eslint.org/docs/latest/rules/array-callback-return
https://eslint.style/rules/js/array-element-newline	https://eslint.org/docs/latest/rules/array-element-newline
https://eslint.org/docs/latest/rules/arrow-body-style	https://eslint.style/rules/js/arrow-parens
https://eslint.org/docs/latest/rules/arrow-parens	https://eslint.style/rules/js/arrow-spacing
https://eslint.org/docs/latest/rules/arrow-spacing	https://eslint.org/docs/latest/rules/block-scoped-var
https://eslint.style/rules/js/block-spacing	https://eslint.org/docs/latest/rules/block-spacing
https://eslint.style/rules/js/brace-style	https://eslint.org/docs/latest/rules/brace-style
https://eslint.org/docs/latest/use/migrating-to-7.0.0#deprecate-node-rules	https://github.com/eslint-community/eslint-plugin-n
https://github.com/eslint-community/eslint-plugin-n/tree/master/docs/rules/callback-return.md	https://eslint.org/docs/latest/rules/callback-return
https://eslint.org/docs/latest/rules/camelcase	https://eslint.org/docs/latest/rules/capitalized-comments
https://eslint.org/docs/latest/rules/class-methods-use-this	https://eslint.style/rules/js/comma-dangle
https://eslint.org/docs/latest/rules/comma-dangle	https://eslint.style/rules/js/comma-spacing
https://eslint.org/docs/latest/rules/comma-spacing	https://eslint.style/rules/js/comma-style

Page 1 of 63

Raw Manifest

{
  "name": "__MSG_scriptcat__",
  "icons": {
    "128": "assets/logo.png"
  },
  "action": {
    "default_icon": {
      "128": "assets/logo.png"
    },
    "default_popup": "src/popup.html"
  },
  "author": "CodFrm",
  "sandbox": {
    "pages": [
      "src/sandbox.html"
    ]
  },
  "version": "1.3.2",
  "incognito": "split",
  "background": {
    "service_worker": "src/service_worker.js"
  },
  "options_ui": {
    "page": "src/options.html",
    "open_in_tab": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_scriptcat_description__",
  "permissions": [
    "tabs",
    "alarms",
    "storage",
    "cookies",
    "offscreen",
    "scripting",
    "downloads",
    "activeTab",
    "webRequest",
    "userScripts",
    "contextMenus",
    "webNavigation",
    "notifications",
    "clipboardWrite",
    "unlimitedStorage",
    "declarativeNetRequest"
  ],
  "default_locale": "en",
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "background"
  ],
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "/src/install.html"
      ]
    }
  ]
}

by ✦ Astarte

ScriptCat

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Embedded URLs (5025 total):

Raw Manifest

Detections

Manifest Findings