Extension Auditor
Extension Auditor
Sign Up
HypeDuck - Reels & Threads Insights

HypeDuck - Reels & Threads Insights

ID: kfnhdnbpeednbokckjghcbhhjbamfbgo

Supported Languages

πŸ‡ΊπŸ‡ΈEnglish
πŸ‡°πŸ‡·Korean

Extension Info & Metadata

Status
Active
Version
0.2.15
Size
2.66 MB
Rating
5.0/5
Reviews
2
Users
940
Type
Extension
Updated
Jul 10, 2026
Category
Productivity Workflow
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Author
https://hypeduck.aiView Profile
Privacy
Privacy Policy
Help
Help Center
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Website
Visit
Total Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Total Users
940
Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5
Screenshot 6
Screenshot 7
Screenshot 8

Scan Instagram Reels and Threads, analyze engagement, and discover trending short-form content.

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
cookies
Permission
High
This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
offscreen
Permission
High
This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness.
downloads
Permission
High
This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:β€’ 20% increase: Access to sensitive domains increases potential impactβ€’ 10% increase: Early script execution enables pre-emptive content manipulation
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
https://www.instagram.com/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://*.instagram.com/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://www.threads.com/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://*.threads.com/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://api.hypeduck.ai/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://hypeduck.ai/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://*.hypeduck.ai/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://graph.baidu.com/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://www.youtube.com/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://www.rednote.com/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://*.rednote.com/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://www.xiaohongshu.com/*
Host
Medium
Host permission β€” access limited to this URL pattern.
https://*.xiaohongshu.com/*
Host
Medium
Host permission β€” access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: https://www.instagram.com/*, https://*.instagram.com/*
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

The installed bundle adds `downloads` and eight host_permission domains (Threads, YouTube, Rednote, Xiaohongshu, Baidu) that are entirely absent from the CWS-published manifest. Conversely, the CWS-listed manifest includes `activeTab`, `tabs`, and `debugger` that are not in the bundle. This bidirectional mismatch indicates the published CWS summary is from a prior version, meaning the current bundle's scope expansion (to multiple new social platforms and a Chinese reverse-image-search service) was not reviewed by CWS. For a 22-day-old extension with 539 users and a Gmail-hosted publisher address, undisclosed scope growth via a silent update is a meaningful risk indicator.

manifest.json (Line 14)
{  "permissions": [    "storage",    "unlimitedStorage",    "cookies",    "scripting",    "offscreen",    "alarms",    "downloads"  ],  "host_permissions": [    "https://www.instagram.com/*",    "https://*.instagram.com/*",    "https://www.threads.com/*",    "https://*.threads.com/*",    "https://api.hypeduck.ai/*",    "https://hypeduck.ai/*",    "https://*.hypeduck.ai/*",    "https://graph.baidu.com/*",    "https://www.youtube.com/*",    "https://www.rednote.com/*",    "https://*.rednote.com/*",    "https://www.xiaohongshu.com/*",    "https://*.xiaohongshu.com/*"  ]}

By severity

Critical0
High1
Medium0
Low0

Versions scanned

None of the 6 scanned versions have more than one unique code-review finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
No versions with multiple unique findings.

Files with findings

1 distinct path β€” top paths by unique finding count:

  • manifest.json1
S.No.
Category
Severity
File
Summary
Found in Version
1Other
high
manifest.json (line 14)The installed bundle adds `downloads` and eight host_permission domains (Threads, YouTube, Rednote, Xiaohongshu, Baidu) that are entirely absent from the CWS-published manifest. Conversely, the CWS-listed manifest inc…
0.2.15
URLs
65
IPv4
1
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
www.hypeduck.ai-https://www.hypeduck.ai
api.hypeduck.ai-https://api.hypeduck.ai
www.threads.com/graphql/queryhttps://www.threads.com/graphql/query
www.threads.com/api/v1/users/$%7Bt%7D/info/%60%7Dfunctionhttps://www.threads.com/api/v1/users/${t}/info/`}function
www.instagram.com/reels/https://www.instagram.com/reels/
www.threads.com-https://www.threads.com
www.youtube.com/youtubei/v1/playerhttps://www.youtube.com/youtubei/v1/player?key=${encodeURIComponent(l
graph.baidu.com/pcpage/indexhttps://graph.baidu.com/pcpage/index?tpl_from=pc&hd_auto=1
link-rest.inpock.co.kr/users/username/$%7BencodeURIComponent(lhttps://link-rest.inpock.co.kr/users/username/${encodeURIComponent(l
link.inpock.co.kr-https://link.inpock.co.kr
Showing 1 to 10 of 70 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
146.0.0.0
IPv4
-
Showing 1 to 6 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In