Extension Details
Context-Aware Verdict
The extension has a strong user rating of 4.9 stars from 22 reviews, indicating positive user experiences. With 3,000 users, it has a modest but reasonable adoption rate for a specialized sports tracking tool. The extension appears to serve a legitimate purpose for MLB baseball fans wanting to track games and statistics.
The storage permission, while necessary for a tracking application to save user preferences and data, could potentially be used to store sensitive information locally. The contextMenus permission allows the extension to modify right-click menus, which could be unnecessary for basic baseball tracking functionality unless it provides quick access to game information. The lack of detailed developer information raises minor transparency concerns. The extension requests no host permissions, which is positive as it suggests limited web access capabilities.
This extension presents moderate risk due to its data storage capabilities. Consider running it in a separate Chrome profile if you're particularly security-conscious, especially if you handle sensitive information in your main browser profile. Before installing, verify that the context menu additions serve a clear purpose for baseball tracking. Monitor what data the extension stores locally and review its behavior periodically. The relatively small user base means less community oversight, so stay alert for any unusual behavior or permission requests in future updates.
Findings
Security Analysis Details
Required Permissions:
- alarms
- storage
- contextMenus
Embedded URLs (13 total):
| https://stackoverflow.com/questions/10491448/how-to-access-jquery-in-html-5-web-worker/33944817#33944817 | https://statsapi.mlb.com | |
| https://www.mlb.com/gameday/ | https://www.mlb.com/scores | |
| https://clients2.google.com/service/update2/crx | https://momentjs.com/timezone/docs/#/use-it/browser/ | |
| http://momentjs.com/timezone/docs/#/data-loading/. | http://momentjs.com/guides/#/warnings/define-locale/ | |
| http://momentjs.com/guides/#/warnings/js-date/ | http://momentjs.com/guides/#/warnings/min-max/ | |
| http://momentjs.com/guides/#/warnings/add-inverted-param/ | http://momentjs.com/guides/#/warnings/zone/ | |
| http://momentjs.com/guides/#/warnings/dst-shifted/ |
Raw Manifest
{ "name": "MLB Baseball Tracker", "icons": { "128": "logos/mlb.png" }, "action": { "128": "logos/mlb.png" }, "version": "3.1", "background": { "service_worker": "background.js" }, "short_name": "MlbBaseballTracker", "update_url": "https://clients2.google.com/service/update2/crx", "description": "Adds an icon with your selected MLB team's game information with real-time score and in-game data.", "permissions": [ "alarms", "storage", "contextMenus" ], "offline_enabled": false, "manifest_version": 3, "web_accessible_resources": [ { "matches": [ "*://*/*" ], "resources": [ "logos/*", "numbers/*" ], "extension_ids": [ "ojihcoimmhapanmaglfhjfddoniigjpg", "pbhopjnalckkgcigcfohmiinmhaamldl" ] } ] }
ⓘ CRXaminer has partnered with our friends at Secure Annex to provide additional findings unique to their platform.
Secure Annex also analyzes extensions from other browsers, IDEs, and can continuously monitor.
This extension may not yet be analyzed by Secure Annex.