[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Moodle Buddy

Version 1.58.0 View in Chrome Web Store

Last scanned: about 6 hours ago

Extension Details

Rating: 4.9 ★ (401 ratings)

Users: 6,000

Context-Aware Verdict

HIGH

Overall Risk

Based on 5 total findings, including 3 high-risk findings.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

activeTab
downloads
storage
scripting

Host Permissions:

<all_urls>

Embedded URLs (128 total):

http://blog.stevenlevithan.com/archives/cross-browser-split	https://en.wikipedia.org/wiki/Base64#URL_applications
https://github.com/beatgammit/base64-js/issues/42	https://feross.org
https://bugzilla.mozilla.org/show_bug.cgi?id=695438	https://github.com/feross/buffer/pull/148
https://github.com/feross/buffer/issues/154	http://stackoverflow.com/a/22747272/680742
https://github.com/feross/buffer/issues/166	https://github.com/feross/buffer/issues/219
https://feross.org/opensource	http://pajhome.org.uk/crypt/md5
https://tailwindcss.com	https://github.com/mozdevs/cssremedy/issues/4
https://github.com/tailwindcss/tailwindcss/pull/116	https://bugzilla.mozilla.org/show_bug.cgi?id=190655
https://bugs.chromium.org/p/chromium/issues/detail?id=999088	https://bugs.webkit.org/show_bug.cgi?id=201297
https://bugs.chromium.org/p/chromium/issues/detail?id=935729	https://bugs.webkit.org/show_bug.cgi?id=195016
https://github.com/mozilla/gecko-dev/blob/2f9eacd9d3d995c937b4251a5557d95d494c9be1/layout/style/res/forms.css#L728-L737	https://github.com/tailwindlabs/tailwindcss/issues/3300
https://github.com/mozdevs/cssremedy/issues/14	https://github.com/jensimmons/cssremedy/issues/14#issuecomment-634934210
http://www.opensource.org/licenses/mit-license.php	https://drafts.csswg.org/css-values-3/#urls
https://developer.chrome.com/devtools/docs/javascript-debugging	http://stackoverflow.com/a/26603875
http://www.w3.org/2000/svg%27%3E%3Cstyle%3E.spinner_V8m1%7Btransform-origin:center	https://vuejs.org/guide/essentials/computed.html#getters-should-be-side-effect-free
https://github.com/vuejs/core	https://vuejs.org/error-reference/#runtime-
http://www.w3.org/2000/svg	http://www.w3.org/1998/Math/MathML
http://www.w3.org/1999/xlink	https://cli.vuejs.org/guide/webpack.html#modifying-options-of-a-loader
https://github.com/vitejs/vite-plugin-vue/tree/main/packages/plugin-vue#example-for-passing-options-to-vuecompiler-sfc	https://github.com/popperjs/popper-core/issues/1223
https://github.com/popperjs/popper-core/issues/837	https://developer.mozilla.org/en-US/docs/Web/CSS/Containing_block#identifying_the_containing_block
https://github.com/facebook/flow/issues/1414	https://github.com/popperjs/popper-core/issues/1078
https://github.com/atomiks/tippy.js-react/issues/106	https://github.com/atomiks/tippyjs-react/issues/177
https://paypal.me/marcelreppi	https://addons.mozilla.org/en-US/firefox/addon/moodle-buddy/
https://chrome.google.com/webstore/detail/moodle-buddy/nomahjpllnbcpbggnpiehiecfbjmcaeo	https://www.w3.org/TR/css-conditional-3/#the-cssconditionrule-interface
https://developer.mozilla.org/en/CSS/@-moz-document	http://dev.w3.org/csswg/cssom/#css-font-face-rule
http://www.opensource.apple.com/source/WebCore/WebCore-955.66.1/css/WebKitCSSFontFaceRule.cpp	https://drafts.csswg.org/cssom/#the-cssgroupingrule-interface
https://www.w3.org/TR/cssom-1/#dom-cssgroupingrule-insertrule	https://www.w3.org/TR/cssom-1/#dom-cssgroupingrule-deleterule
http://www.w3.org/TR/shadow-dom/#host-at-rule	http://dev.w3.org/csswg/cssom/#cssimportrule
http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSImportRule	http://www.w3.org/TR/css3-animations/#DOM-CSSKeyframeRule
http://www.opensource.apple.com/source/WebCore/WebCore-955.66.1/css/WebKitCSSKeyframeRule.cpp	http://www.w3.org/TR/css3-animations/#DOM-CSSKeyframesRule
http://www.opensource.apple.com/source/WebCore/WebCore-955.66.1/css/WebKitCSSKeyframesRule.cpp	http://dev.w3.org/csswg/cssom/#cssmediarule
http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSMediaRule	https://opensource.apple.com/source/WebCore/WebCore-7611.1.21.161.3/css/CSSMediaRule.cpp
http://dev.w3.org/csswg/cssom/#the-cssrule-interface	http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSRule
http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSStyleDeclaration	http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSStyleDeclaration-getPropertyValue
http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSStyleDeclaration-setProperty	http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSStyleDeclaration-removeProperty
http://dev.w3.org/csswg/cssom/#cssstylerule	http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSStyleRule
http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSStyleSheet	http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSStyleSheet-insertRule
http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSStyleSheet-deleteRule	https://drafts.csswg.org/css-conditional-3/#the-csssupportsrule-interface
http://www.w3.org/TR/DOM-Level-2-Style/css.html#CSS-CSSValue	http://msdn.microsoft.com/en-us/library/ms537634
http://dev.w3.org/csswg/cssom/#the-medialist-interface	http://dev.w3.org/csswg/cssom/#the-stylesheet-interface

Page 1 of 2

Raw Manifest

{
  "name": "Moodle Buddy",
  "icons": {
    "16": "icons/16.png",
    "32": "icons/32.png",
    "48": "icons/48.png",
    "128": "icons/128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/16-gray.png",
      "32": "icons/32-gray.png",
      "48": "icons/48-gray.png",
      "128": "icons/128-gray.png"
    },
    "default_popup": "popup/index.html",
    "default_title": "Moodle Buddy"
  },
  "version": "1.58.0",
  "background": {
    "service_worker": "background.js"
  },
  "options_ui": {
    "page": "pages/options/options.html",
    "open_in_tab": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Moodle Buddy offers mass file download and notification functionality for the moodle learning management platform.",
  "permissions": [
    "activeTab",
    "downloads",
    "storage",
    "scripting"
  ],
  "content_scripts": [
    {
      "js": [
        "content-scripts/index.js"
      ],
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "browser_specific_settings": {
    "gecko": {
      "id": "moodlebuddy@marcelreppi"
    }
  }
}

by ✦ Astarte

Moodle Buddy

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (128 total):

Raw Manifest

Detections

Manifest Findings