[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

JSON Formatter

Version 0.10.2 View in Chrome Web Store

Last scanned: 15 days ago | force re-scan

Extension Details

Developer: callumlocke.com

Rating: 4.3 ★ (2.1K ratings)

Users: 2,000,000

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has strong user adoption with 2 million users and a solid 4.3-star rating from over 2,000 reviews, indicating general user satisfaction. The author domain "callumlocke.com" suggests an individual developer rather than a corporate entity. JSON formatting is a legitimate developer tool need, which aligns with the extension's stated purpose.

Concerns: The primary concern is the excessive permissions for a JSON formatting tool. The extension requests access to all websites (*://*/*) and can inject content scripts everywhere, which is unnecessary for formatting JSON data that could be handled locally. A JSON formatter typically only needs to work on pages containing JSON content or provide a standalone formatting interface. The broad host permissions create potential attack vectors for data theft, credential harvesting, or malicious script injection across all websites you visit. The storage permission, while lower risk, adds another data collection capability.

Recommendations: Consider using this extension in a separate Chrome profile dedicated to development work to limit exposure of your personal browsing data. Alternatively, look for JSON formatting extensions with more restrictive permissions, or use standalone JSON formatting tools or browser developer tools instead. If you must use this extension, regularly review what data it might be accessing and consider disabling it when not actively formatting JSON. Monitor for any unusual browser behavior or performance issues that could indicate misuse of the broad permissions.

Findings

HIGH

Broad Content Script Injection

This extension can inject scripts into any website. This means it could potentially read sensitive data, modify website content, or steal credentials.

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "JSON Formatter",
  "icons": {
    "32": "icons/32.png",
    "128": "icons/128.png"
  },
  "version": "0.10.2",
  "options_ui": {
    "page": "options/options.html",
    "open_in_tab": false
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Makes JSON easy to read",
  "permissions": [
    "storage"
  ],
  "homepage_url": "https://github.com/callumlocke/json-formatter",
  "content_scripts": [
    {
      "js": [
        "content.js"
      ],
      "run_at": "document_end",
      "matches": [
        "<all_urls>"
      ]
    },
    {
      "js": [
        "set-json-global.js"
      ],
      "world": "MAIN",
      "run_at": "document_idle",
      "matches": [
        "<all_urls>"
      ]
    }
  ],
  "host_permissions": [
    "*://*/*",
    "<all_urls>"
  ],
  "manifest_version": 3,
  "minimum_chrome_version": "88"
}

by ✦ Astarte

JSON Formatter

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (2 total):

Raw Manifest

Detections

Manifest Findings