Security Alert: Critical Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: Conch AI

CRITICAL RISK

Conch AI

ID: namibaeakmnknolcnomfdhklhkabkchl

Extension Info & Metadata

Status

Active

Version

1.3.5

Size

0.73 MB

Rating

4.7/5

Reviews

207

Users

80,000

Type

Extension

Updated

Oct 26, 2024

Publisher Contextual Analysis

Trusted

Author: getconch.aiView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

80,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Get your work done 10x faster anywhere with AI. Summarize articles, books, and pdfs.

Get your work done 10x faster anywhere with AI. Summarize articles, books, PDFs, webpages. Generate, summarize, and rewrite anything, anywhere on the internet to save over hours each week. Discover Conch's full blown feature set below. 🤖 Features - AI commands: Highlight and rewrite sentences and paragraphs, summarize selected text from PDFs, books, and articles, paraphrase text, and much more. - Study: Generate notes, flashcards, and mind maps instantly from anything. Ask questions about the current website, any article or PDF and Conch AI will dig for answers. 10x better than the default find. - AI Humanizer: Rewrite AI generated text to bypass AI detectors like Turn It In, GPTZero, and more. - Chat: Ask questions about the current website, any article, or any PDF and the AI will dig for answers. Bonus: Generate Next Sentence: Press CTRL + shift + Q to magically generate the next sentence from where you left off on Google Docs, or your favorite document editor. Supported on: Google Docs PDFs Gmail Linkedin News websites And so much more! This extension directly integrates with your account/subscription at getconch.ai, the all-in-one AI tool for school. All studysets, chats, and sources for documents will be stored with your account.

User Growth

Showing data from Feb 16, 2023 to Feb 15, 2024

Versions

-20%(-20,000 users)

Compared to 3 months ago

19 versions released in this period

Rating Count

Total: 201 ratings

Average Rating

Current: 4.73 / 5.0+4.73

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium2

Low0

Versions scanned

Showing 1 of 24 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.3.5 Code review	6

Extension Version	Code Review Findings
1.3.5	6

Files with findings

3 distinct paths — top paths by unique finding count:

assets/content.js-CT05Gyqb.js4
assets/background.js-C_Qfa9ru.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	assets/content.js-CT05Gyqb.js (line 70)	On every page, the content script listens for window postMessages tagged 'Penora-Login:<email>' and, upon receiving one from arbitrary web content, calls the backend /auth/create-user to mint an accessToken/userId for…	1.3.5
2	Privilege Escalation	high	manifest.json (line 35)	externally_connectable is set to <all_urls>, meaning any website on the internet can open a runtime.connect/sendMessage channel to this extension's service worker. Combined with the onMessageExternal handler in the ba…	1.3.5
3	Unauthorized Data Collection	high	assets/content.js-CT05Gyqb.js (line 49)	The content script injects into every URL (manifest matches <all_urls>) and unconditionally harvests the full page innerText, title, and URL on initial load, SPA navigation (popstate), and every visibilitychange. This…	1.3.5
4	Unauthorized Data Collection	high	assets/content.js-CT05Gyqb.js (line 85)	Every mouseup on any website triggers capture of whatever text the user has selected and sends it to the extension background, where it is persisted to chrome.storage.local as 'selectedText'. Combined with the <all_ur…	1.3.5
5	Data Exfiltration	medium	assets/content.js-CT05Gyqb.js (line 1)	The content script hardcodes a '-test' Heroku endpoint (conch-backend-test.herokuapp.com) as its production auth server and sends user email, accessToken, and userId to it. Shipping a 100k-user production extension th…	1.3.5
6	Unauthorized Data Collection	medium	assets/background.js-C_Qfa9ru.js (line 21)	The background service worker persists captured page content, page title, page URL, text selections, and 'USER_FETCHED' data (email + accessToken + userId + user record) into chrome.storage.local without encryption. A…	1.3.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


app.getconch.ai	/sign-up	https://app.getconch.ai/sign-up?from=extension
tally.so	/r/3XLGKL	https://tally.so/r/3XLGKL
conch-backend-test.herokuapp.com	-	https://conch-backend-test.herokuapp.com
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Inter:ital,opsz,wght@0,14..32,100..900;1,14..32,100..900&display=swap
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

i just tried ai and its free and so much better im going to get so much better grades

DB_Zack mak (DB_ZACK)·23 Sept 2024

Explore new opportunities with us to increase revenue and expand your chrome extension. See how we can help you. Details at: https://extensionbuysell.com We are looking forward to working with you! Best regards,

Madison Francis·15 Sept 2024

Awarie u mnie!!!

Grzegorz Majewski (Grzesimaj lub Giga)

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Critical Security Risk

Conch AI

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 24 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating