What our analysis found

웨않되 - 맞춤법 검사기, used by 10,000 people, is rated caution by Extension Auditor. Our code review reported 4 findings (1 critical, 1 high, 2 medium), led by other. Its permissions mean it can read and change data on all websites.

Key findings

• critical· other —Decoded, this block calls `chrome.declarativeNetRequest.updateDynamicRules` (St=declarativeNetRequest, Ot=updateDynamicRules) to add rule id=10 modifying request headers (Ut=modifyHeaders) for navigations matching a URL filter that decodes to ` ].com/…` (a Korean link domain), setting the HTTP `referer` header to ` and `sec-Fetch-Dest: document` on `main_frame` and `sub_frame` navigations. Spoofing the HTTP Referer to ` ` on coupon link clicks attributes affiliate conversions to the extension developer's advertising account — this is affiliate click fraud that monetises users' shopping behaviour without disclosure and is entirely unrelated to spellchecking.
• high· obfuscation —The `bt()` function implements a Caesar cipher that decodes obfuscated strings at runtime. It is applied exclusively to the block at lines 2126–2135 that calls `chrome.declarativeNetRequest.updateDynamicRules` — while all legitimate spellcheck code is left in plain text. This selective obfuscation is designed to hide the affiliate fraud rule from automated reviewers and manual code inspection.
• medium· tracking —The extension sends analytics events to Google Analytics (measurement ID G-ZWXHCSW4V1) including `inspectionDomain` (the hostname of every website where the user activates spellchecking), a persistent per-device UUID stored in `chrome.storage.sync` as WAD, and potentially search keyword + domain pairs (`getSearchKeywordEvent` collects `{k: keyword, d: domain}`). The CWS-disclosed data collection is explicitly 'none declared', making this undisclosed behavioural tracking of browsing activity across all websites.
• medium· other —On every load of the background service worker the extension sends an inter-extension message to a hardcoded third-party extension ID (`gmfkgfndfdfgbghjmmcpakibpbjpbfok`) with type `uninstall`. This could attempt to communicate with or trigger behaviour in a companion extension; the specific message type suggests it may try to trigger self-removal or a related extension's removal, though the target extension's response handler controls the actual effect.

contains intentionally obfuscated code (the `bt()` Caesar-cipher function at line 2043) that, when decoded, reveals a `chrome.declarativeNetRequest.updateDynamicRules()` call (lines 2126–2135) setting HTTP Referer headers to ` for user navigations matching coupon-link URL patterns — classic affiliate click fraud that credits the extension developer's advertising account for user shopping actions with no relation to spellchecking. The selective obfuscation of this specific block while leaving all legitimate spellcheck code readable demonstrates intentional concealment from reviewers. The ML score of 0.00 is a false-negative because the Caesar cipher hid the fraud from pattern matching; chrome-stats' low likelihood score similarly failed to detect it.