Chrome Web StoreCaution required
Suspicious in code review (v1.9)
Our reviewer found behaviour consistent with malware in version 1.9, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
Anywear: Live Virtual Try-On, used by 50,000 people, is rated caution by Extension Auditor. Our code review reported 1 finding (1 high), led by other. It comes from a trusted publisher and was last updated in October 2026.
Key findings
- High
Other
A Supabase service_role JWT is hardcoded in publicly-readable client-side JavaScript. The JWT payload decodes to {"role":"service_role"}, which Supabase documents as bypassing all Row-Level Security policies — the in-code comment explicitly acknowledges this. Any user who installs the extension can extract this key and gain unrestricted read/write/delete access to the entire Supabase project, including all user analytics rows (installation_ids, page_urls, session data) accumulated across all 4,000+ installs. This is developer negligence rather than intentional exfiltration, but the effective outcome is that every user's browsing-session analytics are exposed to any third party who reads the extension source.
Analyst notes
The extension's core functionality cleanly matches its stated purpose — AI virtual try-on injected only on detected fashion sites, with analytics disclosed under CWS 'Website content' and 'Personally identifiable information' flowing to Decart's own Supabase and PostHog. However, a Supabase service_role JWT (which explicitly bypasses all RLS policies per the in-code comment) is hardcoded in client-side JavaScript at:751, exposing the entire analytics database (installation_ids, page URLs, session data for every user) to any actor who reads the extension source. Publisher signals are independently alarming: email, a publisher website URL that resolves to a Google support page, a publisher-level privacy policy pointing to Google's own account privacy page, and a 34% malicious-extension rate across 185 published extensions — all indicating the publishing entity is either a reseller or a shell, even if this specific extension's code is legitimate.
Anywear: Live Virtual Try-On Chrome extension security report
ID: hijnklblgecbdlhjiofhlhjpndpifejh
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- dev
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- 340 Hauser Blvd Apt 428 Los Angeles, CA 90036 US
- Website
- Visit
Screenshots & videos
Install growth
No Security Analysis Available
Security analysis has not been performed for this extension version yet.
About this extension
Try on clothes virtually on any fashion website, powered by Decart.
Read the publisher’s full description
Try-on any clothes from any site. Drag, drop, see it on yourself. How it works 1) Install the extension 2) Go to any fashion site 3) Drag a garment into the pop up window 4) See it on you instantly By installing this extension, you agree to Decart's Terms of Service and Privacy Policy. Powered by Decart AI.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from dev
- WebStart+ New Tab100,000 users
- MultiSearch60,000 users
- Chakra Scout60,000 users
- OKZOO10,000 users
- CoAuthor - Amazon Book Research7,000 users
Popular in lifestyle/shopping
- Capital One Shopping: Save Now11,000,000 users
- Rakuten: Get Cash Back For Shopping3,000,000 users
- Méliuz: Cashback e cupons em suas compras1,000,000 users
- 買い物ポケット800,000 users
- 萤火虫惠聚800,000 users