Zendesk Download Router

Version 5.0.0 View in Chrome Web Store

Last scanned: about 1 month ago | force re-scan

Extension Details

Rating: 4.8 ★ (10 ratings)

Users: 708

Context-Aware Verdict

HIGH

Overall Risk

Trust Factors: The extension has a very small user base of only 708 users, which limits community validation. However, it maintains a high rating of 4.8 stars from 10 reviews, suggesting those who use it are satisfied. The extension targets Zendesk specifically, which is a legitimate business platform, and the content scripts are appropriately scoped to Zendesk domains only.

Concerns: The extension requests several powerful permissions that create significant security risks. The downloads permission allows complete access to download functionality and history, which could be exploited to download malicious files or monitor user download behavior. The tabs permission grants broad access to manipulate browser tabs and view tab information across all websites, not just Zendesk. The combination of these permissions with the small user base raises concerns about the extension's necessity for such broad access. The lack of developer information and company details makes it difficult to verify the extension's legitimacy and accountability.

Recommendations: Given the high-risk permissions and limited user validation, consider running this extension in a separate Chrome profile to isolate potential security risks. Before installation, verify that you actually need download routing functionality for Zendesk and cannot achieve the same result through Zendesk's native features. Monitor the extension's behavior closely after installation and remove it immediately if you notice any unexpected download activity or tab manipulation outside of Zendesk contexts.

Findings

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: activeTab

This extension has the activeTab permission. Can access the active tab when clicking the extension icon.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Raw Manifest

{
  "name": "Zendesk Download Router",
  "icons": {
    "32": "icon/32.png",
    "48": "icon/48.png",
    "64": "icon/64.png",
    "128": "icon/128.png"
  },
  "action": {
    "default_icon": {
      "128": "/icon/128.png"
    },
    "browser_style": true,
    "default_popup": "popup.html",
    "default_title": "Zendesk Download Router"
  },
  "version": "5.0.0",
  "background": {
    "type": "module",
    "service_worker": "background.js"
  },
  "options_ui": {
    "page": "options.html",
    "open_in_tab": true
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "Automatically routes Zendesk downloads into separate folders by ticket number",
  "permissions": [
    "activeTab",
    "downloads",
    "storage",
    "tabs"
  ],
  "content_scripts": [
    {
      "js": [
        "content-scripts/content.js"
      ],
      "css": [
        "content-scripts/content.css"
      ],
      "run_at": "document_end",
      "matches": [
        "*://*.apps.zdusercontent.com/*",
        "*://*.zendesk.com/*"
      ]
    }
  ],
  "manifest_version": 3,
  "web_accessible_resources": [
    {
      "matches": [
        "*://*.zendesk.com/*",
        "*://*.apps.zdusercontent.com/*"
      ],
      "resources": [
        "/icon/128.png"
      ]
    }
  ]
}

by ✦ Astarte

https://github.com/wxt-dev/wxt/issues/371	https://wxt.dev/guide/go-further/testing.html
https://clients2.google.com/service/update2/crx	http://www.w3.org/2000/svg

Zendesk Download Router

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Embedded URLs (4 total):

Raw Manifest

Detections

Manifest Findings