Chrome Web StoreCaution required
Suspicious in code review (v1.0.10)
Our reviewer found behaviour consistent with malware in version 1.0.10, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
101 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Exporter for Copilot - Export Copilot Chats to PDF, Markdown, used by 1,000 people, is rated caution by Extension Auditor. Our code review reported 3 findings (1 high, 2 medium), led by other. Its permissions mean it can inject scripts into pages.
Key findings
- High
Other
The bundled manifest grants three things the published CWS manifest summary does not list: the activeTab permission (line 20) and the two enterprise Microsoft 365 Copilot hosts [domain withheld] and [domain withheld] (lines 32-33), which are also added to content_scripts.matches (lines 65-66) so and run inside corporate M365 Copilot sessions. This is exactly the host surface on which the undisclosed upload below operates, widening the blast radius from consumer chats to tenant chats. I cannot tell from the artifact alone whether the ZIP is newer than the listing snapshot or the reverse, so this is a divergence to reconcile against the live listing, not evidence of a delayed-malicious push.
- Medium
Unauthorized Data Collection
Every PDF export uploads the complete rendered conversation HTML plus the originating page URL to the publisher's Cloud Run backend;:958 tries this server path FIRST on each export and only falls back to local html2pdf rendering if the server call fails, so it is the default, not an opt-in. The destination is first-party, but the CWS data-collection disclosure for this listing is 'none declared', and the publisher's own store copy (, 'en' block) advertises 'Works Offline', 'No Tracking — No analytics or data collection' and 'Your conversations stay on your device' — so the transmitted category (full contents) is undisclosed and actively contradicted. With the bundled manifest injecting into [domain withheld].microsoft and [domain withheld], this can carry enterprise M365 Copilot conversation text off-device.
- Medium
Unauthorized Data Collection
On every export (including local exports that never touch the server renderer) the extension POSTs the chat title, filename and full source URL to the publisher backend, attached by _fetch to a persistent per-install UUID in the X-Client-ID header (lines 39-54, crypto.randomUUID stored in chrome.storage.sync). Quota enforcement needs only a counter, not conversation titles and URLs, so this builds a server-side, re-identifiable log of which Copilot conversations a given install opened. Again undisclosed: CWS declares no data collection and the listing text claims no analytics or data collection.
Analyst notes
The code is a coherent, commercially-monetised Microsoft Copilot chat exporter (Stripe plans, anonymous X-Client-ID quota, Google sync via chrome.identity), and I found no credential theft, no token reads (grep for in and returns nothing), no, no remote code loading and no third-party sink — so the ML score's raw drivers (82 innerHTML / 109 appendChild are DOM cloning and PDF templating in and; the 2 MB JS total is inflated by the 323 KB dev-only of localized store copy and by unreachable sibling-platform scripts that this manifest never loads and that cannot be injected, there being no scripting permission or executeScript call). What keeps this above 'likely_benign' is a disclosure problem, not obfuscation: by default every export POSTs the full conversation HTML plus the page URL to the publisher's Cloud Run backend (.js:346), and every export also POSTs the chat title and source URL keyed to a persistent client UUID (), while CWS data collection is declared 'none' and the store copy the publisher generates itself claims 'Works Offline', 'No Tracking — No analytics or data collection' and 'Your conversations stay on your device'; the bundled manifest also grants activeTab and the enterprise M365 Copilot hosts ([domain withheld].microsoft, [domain withheld]) that the published listing snapshot does not show. The permhash cluster (59% flagged) and the imported malext label corroborate the ML score but the label's own basis states it is not a code review, while the trusted-publisher badge, the clean sibling extensions and the code itself contradict it; confidence is medium because is declared in content_scripts but absent from this bundle, so one injected library went unreviewed.
Exporter for Copilot - Export Copilot Chats to PDF, Markdown Chrome extension security report
ID: nghpoklfiggkdemkmgllkaaiemggmdao
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Neo Cortex LLC
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
Sensitive Domain Access
This extension has access to the following sensitive domains:
- https://*.amazonaws.com/*
- https://*.googleusercontent.com/*
- https://www.googleapis.com/*
101 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Export Copilot chats to PDF or Markdown instantly. Save conversations, download chats, and archive discussions with one click.
Read the publisher’s full description
🚀 Export Microsoft Copilot Chats to PDF, Markdown, or JSON in Seconds Never lose an important AI conversation again. Microsoft Copilot to PDF lets you export chats to PDF, Markdown, or JSON instantly. Save, download, and archive your AI conversations with one click — including code, images, math, and full formatting. Perfect for saving Microsoft Copilot and other AI chat conversations as clean, shareable files. No copy-paste. No screenshots. No messy print to PDF workarounds. 📸 CLEAN, ACCURATE CHAT EXPORTS Microsoft Copilot to PDF captures your conversations exactly as you see them: • Code blocks keep their syntax highlighting • Tables, math (LaTeX), and structured content stay intact • Images and attachments are included • Links, headings, and formatting are preserved • The original layout remains clean and readable • Even very long chats export without breaking Your exported files are polished, easy to read, and ready to share, store, or revisit anytime. ⚡ POWERFUL CHAT EXPORT FEATURES • One-Click Export — Save the current chat instantly • Batch Export — Export multiple conversations at once • Multiple Formats — PDF, Markdown (.md), JSON, or Plain Text • High-Quality PDF Export — No cut-off pages or broken layouts • Formatting Preserved — Headers, lists, links, and styles stay intact • Works Offline — Export chats without an internet connection • Works with Long Chats — Handles large conversations smoothly ☁️ OPTIONAL CLOUD SYNC (PRO) • Automatic backups to Google Drive, Dropbox, Notion, or Yandex Disk • Access your exported chats from anywhere • Keep your AI conversations organized and secure 🔒 PRIVATE & SECURE BY DESIGN Your data stays on your device. • No account required • No uploads to external servers • No tracking or analytics • No telemetry or hidden data collection Everything is processed locally, making it safe for sensitive work, research, and personal use. 🛠️ WHO IT’S FOR Developers, students, writers, professionals, and researchers who want to save, organize, and revisit AI conversations. • Developers — Save code snippets and debugging sessions • Students — Keep study material and research organized • Writers & Creators — Store ideas, drafts, and content • Professionals — Document workflows and planning • Researchers — Preserve detailed discussions ⭐ WHY USERS CHOOSE MICROSOFT COPILOT TO PDF ✔ Fast and reliable, even for very long chats ✔ Cleaner and more accurate than copy-paste or print methods ✔ Designed specifically for AI chat export ✔ Lightweight, simple, and easy to use ✔ Supports multiple export formats 📥 INSTALL NOW Install Microsoft Copilot to PDF and start saving your AI chats as clean, shareable files in seconds.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
101 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from Neo Cortex LLC
- AI Chat Exporter - ChatGPT, Claude, Gemini & DeepSeek to PDF3,000 users
- Substack Video Downloader - Download Videos, Podcasts & MP32,000 users
- Substack PDF Downloader - Export Substack to PDF, Markdown, JSON, Text2,000 users
- Grok to PDF - Export Grok Chats to PDF, Markdown, JSON1,000 users
- Perplexity Chat Exporter - Export Perplexity to PDF, Markdown, JSON858 users
Popular in Workflow & Planning
- Adobe Acrobat: PDF edit, convert, sign tools347,000,000 users
- Application Launcher For Drive (by Google)101,000,000 users
- AdBlock — block ads across the web64,000,000 users
- Chrome Remote Desktop41,000,000 users
- Adblock Plus - free ad blocker40,000,000 users
Store rankings
Where this extension appears in store category, collection and keyword rankings.