[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Onestart Extension

Version 0.2.3 View in Chrome Web Store

Last scanned: about 5 hours ago

Extension Details

Rating: 5.0 ★ (1 rating)

Users: 10,000

Context-Aware Verdict

CRITICAL

Overall Risk

Based on 7 total findings, including 5 high-risk findings.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

alarms
cookies
declarativeNetRequest
declarativeNetRequestWithHostAccess
scripting
storage
tabs
unlimitedStorage
webNavigation
webRequest

Host Permissions:

*://*/*

Embedded URLs (656 total):

http://www.w3.org/2000/svg	https://vuejs.org/error-reference/#runtime-
http://www.w3.org/1998/Math/MathML	http://www.w3.org/1999/xlink
http://www.w3.org/1999/xhtml	https://static.slickdealscdn.com
https://empty.invalid	https://apps.apple.com/us/app/slickdeals-for-safari/id1616734542
https://addons.mozilla.org/en-US/firefox/addon/slickdeals/reviews/	https://microsoftedge.microsoft.com/addons/detail/slickdeals-automatic-cou/dbcjahjgmipefpapjkbcjeglciobkiih
https://chrome.google.com/webstore/detail/slickdeals-automatic-coup/jpdapbcmfllbpojmkefcikllfeoahglb/reviews	https://fonts.googleapis.com/css2?family=Inter:wght@300
https://fonts.googleapis.com/css2?family=Blinker:wght@400	https://fonts.googleapis.com/css2?family=Work+Sans:ital
https://onestart.ai/privacy-policy/	https://coupons.onestart.ai/terms.html
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	https://www.google-analytics.com/mp/collect
https://secure.newegg.com/Shopping/ShoppingCart.aspx	https://www.victoriassecret.com/commerce2/offers/remove?offerCode=%promo
https://www.sears.com/crsp/api/cart/v1/coupon/add?ts=%timestamp	https://www.sears.com/crsp/api/cart/v1/view?ts=%timestamp
https://www.sears.com/crsp/api/cart/v1/coupon/remove?ts=%timestamp	https://react-native.canny.io/feature-requests/p/fetch-streaming-body
https://github.com/aws/aws-sdk-js-v3#functionality-requiring-aws-common-runtime-crt	https://s3-fips.dualstack.
https://s3.dualstack.	https://s3-fips.dualstack.us-east-1.
https://s3-fips.us-east-1.	https://s3.dualstack.us-east-1.
https://aws.amazon.com/javascript/	https://github.com/aws/aws-sdk-js-v3/tree/main/clients/client-s3
https://github.com/aws/aws-sdk-js-v3.git	https://github.com/lancedikson/bowser
https://www.forever21.com/on/demandware.store/Sites-forever21-Site/en_US/Cart-AddCoupon?csrf_token=%token&couponCode=%promo	https://www.forever21.com/us/shop/checkout/basket
https://www.hotels.com/booking/apply_discount.html	https://www.officedepot.com/json/addCoupon.do?couponCode=%promo
https://www.officedepot.com/async/cart/getCartInfo.do	https://www.officedepot.com/json/removeCoupon.do?couponCode=%promo
https://secure-www.gap.com/buy/resources/shoppingBag/v1/%accountID	https://www.finishline.com/store/checkout/applyCouponJsonResponse.jsp
https://www.finishline.com/store/checkout/gadgets/checkoutOrderSummary.jsp?currentStage=cart&cartType=page	https://secure.asos.com/api/commerce/bag/v4/bags/%bagId/discounts?expand=delivery
https://www.frys.com/wf	https://www.frys.com/ShopCartServlet?action=display_cart
https://secure.wayfair.com/a/checkout/basket/update_promotion_or_gift_certificate	https://www.wayfair.com/a/checkout/basket/show
https://www.dell.com/csbapi/en-us/buy/coupon	https://www.pizzahut.com/api.php/site/api_ajax/coupons/applyCouponCode
https://www.pizzahut.com/api.php/site/api_pages/api_order_summary/getSummaryData	https://www.pizzahut.com/api.php/site/api_ajax/order/removeItem
https://www.walgreens.com/cart/v1/promos	https://www.adidas.com/api/checkout/baskets/%basketId/coupons/
https://www.fanatics.com/api/cart/%cartID/promotion	https://www.sears.com/crsp/api/cart/v1/coupon/add
https://www.sears.com/crsp/api/cart/v1/view	https://www.sears.com/crsp/api/cart/v1/coupon/remove
https://www.rakuten.com/buy/coupon_discount.json	https://www.wish.com/api/promo-code/apply
https://www.bloomingdales.com/my-bag/%bagID/promo?currencyCode=USD&promoCode=%promo	https://www.overstock.com/cartajax?requestType=campaignApply
https://www2.hm.com/en_us/v1/vouchers	https://www2.hm.com/en_us/v1/carts
https://www.gamestop.com/on/demandware.store/Sites-gamestop-us-Site/default/Cart-AddCoupon	https://www.columbia.com/on/demandware.store/Sites-Columbia_US-Site/en_US/Cart-AddCoupon?csrf_token=%token&couponCode=%promo
https://www.kohls.com/cnc/applyCoupons?pageName=cart	https://www.kohls.com/checkout/shopping_cart.jsp
https://www.samsung.com/us/api/ecom/v4/shopping-carts/%cartID/coupon-codes	https://www.ulta.com/services/v6/cart/coupon/add?couponCode=%promo
https://order-api.jcpenney.com/order-api/v1/accounts/%accountID/draft-order/adjustment/discounts	https://order-api.jcpenney.com/order-api/v1/accounts/%accountID/draft-order?expand=status
https://www.jcrew.com/checkout-api/graphql	https://www.monoprice.com/Cart/CartUpdatePartialB2C
https://www.champion.com/checkout/cart/couponPost/	https://www.adorama.com/api/user/addGiftCouponCode
https://www.adorama.com/api/user/removeGiftCouponCode	https://www.splendid.com/checkout/cart/couponPost/
https://www.splendid.com/checkout/cart/	https://www.petsmart.com/on/demandware.store/Sites-PetSmart-Site/default/CartController-ApplyPromo

Page 1 of 9

Raw Manifest

{
  "name": "Onestart Extension",
  "icons": {
    "16": "icons/16.png",
    "19": "icons/19.png",
    "32": "icons/32.png",
    "38": "icons/38.png",
    "48": "icons/48.png",
    "64": "icons/64.png",
    "96": "icons/96.png",
    "128": "icons/128.png",
    "256": "icons/256.png",
    "512": "icons/512.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/16.png",
      "19": "icons/19.png",
      "32": "icons/32.png",
      "38": "icons/38.png"
    },
    "default_popup": "src/entries/popup/index.html"
  },
  "version": "0.2.3",
  "background": {
    "type": "module",
    "service_worker": "serviceWorker.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Never miss a deal! Apply coupons automatically at checkout and save everyday!",
  "permissions": [
    "alarms",
    "cookies",
    "declarativeNetRequest",
    "declarativeNetRequestWithHostAccess",
    "scripting",
    "storage",
    "tabs",
    "unlimitedStorage",
    "webNavigation",
    "webRequest"
  ],
  "content_scripts": [
    {
      "js": [
        "src/entries/contentScript/globalStart/index.js"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ]
    }
  ],
  "host_permissions": [
    "*://*/*"
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "<all_urls>"
      ],
      "resources": [
        "assets/DealIcon@2x-D9L1rw4x.png",
        "assets/ExtensionWindow-RFzFC3hl.css",
        "assets/ExtensionWindow.vue_vue_type_style_index_0_lang-BqYVDExW.js",
        "assets/cart-mtM4UKjK.png",
        "assets/documentReady-CQ1hhR9S.js",
        "assets/extensionMessagingV5-DZMCJpdF.js",
        "assets/headerBanners-B2eO-x7R.js",
        "assets/index-Dv1GNk_O.css",
        "assets/initializable-CFWIdnYb.js",
        "assets/onestart-logo-mI_7GIfn.svg",
        "assets/onestart-logo-with-text-Ds3UlYFo.svg",
        "assets/preload-helper-DfZQVC28.js",
        "assets/src/entries/contentScript/global/index-CXj8M3G1.js",
        "assets/userActionsService-CEA_zAYG.js",
        "src/entries/contentScript/global/index.js",
        "src/entries/frameProxy/frameProxy.html"
      ]
    },
    {
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "resources": [
        "assets/src/entries/contentScript/globalStart/index-C9wxdXCk.js",
        "assets/preload-helper-DfZQVC28.js",
        "assets/extensionMessagingV5-DZMCJpdF.js",
        "assets/pageInteraction-CWbH3Iz4.js",
        "assets/initializable-CFWIdnYb.js",
        "assets/documentReady-CQ1hhR9S.js"
      ]
    }
  ]
}

by ✦ Astarte

Onestart Extension

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (656 total):

Raw Manifest

Detections

Manifest Findings