Chrome Web StoreCaution required
Suspicious in code review (v1.0)
Our reviewer found behaviour consistent with malware in version 1.0, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
12 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Creator Studio Extension, used by 5,000 people, is rated caution by Extension Auditor. Our code review reported 1 finding (1 medium), led by unauthorized data collection. It comes from a publisher with 2 extensions and was last updated in August 2021.
Key findings
- Medium
Unauthorized Data Collection
The extension grants `chrome.runtime.onMessageExternal` access to any page on `*.[domain withheld]`, a domain unrelated to Medium or the extension's stated purpose. Any MSN-hosted page can silently send `{productType: "medium"}` to this extension and receive back the user's logged-in Medium username (derived from their session redirect) and full RSS feed. While the RSS content is nominally public, the silent username-extraction constitutes identity correlation against an unauthenticated visitor without disclosure. No legitimate Medium creator tool requires [domain withheld] as an externally-connectable host.
Analyst notes
The extension's core logic is straightforward and legitimate — it fetches the signed-in user's Medium RSS feed via [domain withheld]. However, the bundled manifest includes `externally_connectable: {"matches": ["*://*.[domain withheld]"]}`, which allows any page on [domain withheld] to silently invoke the extension and receive the user's Medium username and full feed without any user gesture. This domain has no plausible relationship to a Medium content-creator tool, creating an unauthorized cross-origin identity-correlation channel. The publisher's portfolio ( other extensions flagged malicious) significantly elevates suspicion, while the ML score and chrome-stats both independently flag the extension — though the ML evidence (small file count, minimal feature footprint) is weak on its own.
Creator Studio Extension Chrome extension security report
ID: eibiflibbmfcpholegdjnndpadbadnmd
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- dralpus
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Screenshots & videos
Install growth
12 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
When a user who has published articles or blog posts on Medium.com is signed into their Medium.com account, this extension enables…
Read the publisher’s full description
When a user who has published articles or blog posts on Medium.com is signed into their Medium.com account, this extension enables the retrieval of that user's 10 most recent Medium articles in the format of an HTML string containing an RSS feed. Users should install this extension if they want to be able to access their Medium articles or blog posts in a portable format, thus allowing them to share their content to a broader audience if desired. This extension guarantees privacy by retrieving content if and only if the user is signed in to Medium.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
12 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from dralpus
- IPNYB Viewer for Raw GitHub192 users
Popular in Social Networking
- Cisco Webex Extension22,000,000 users
- LINE4,000,000 users
- Mosaic Wallet4,000,000 users
- Google Mail Checker2,000,000 users
- Bitmoji2,000,000 users