Chrome Web Store
4Versions
1Code reviewed

Caution required

Suspicious in code review

Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.

2 medium-severity findings in this extension’s code

2 medium
23 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

What our analysis found

JUAN - The Community Driven Crypto Extension is rated caution by Extension Auditor. Our code review reported 2 findings (2 medium), led by other. It comes from a publisher with 4 extensions and was last updated in June 2026.

Key findings

  • Medium

    Other

    The bundled manifest declares `alarms` as a permission but the live CWS public manifest omits it entirely, and the live CWS manifest lists `[domain withheld] as a host permission that the bundled manifest does not include. The undisclosed `alarms` permission is actively used in (line 37) to schedule a persistent 30-second polling loop against the backend — behavior that reviewers and users would not see in the store listing. Hiding a background-scheduling capability from the public manifest is an integrity violation regardless of whether the polling itself is benign.

  • Medium

    Other

    The Google OAuth client secret `GOCSPX- -6aG` is hardcoded in client-side JavaScript that ships inside the extension ZIP, making it trivially extractable by anyone who downloads the extension. This same secret is duplicated in at line 90. A PKCE flow is designed for public clients that have no client secret; the presence of a secret here is architecturally incorrect and its exposure means any party can craft authorization code exchanges using this extension's registered OAuth identity, potentially enabling phishing flows that appear to originate from this legitimate-looking application.

Analyst notes

The extension's JavaScript implements a recognizable, readable crypto-community feature set — portfolio tracking, cashtag highlighting on Twitter, community chat, and social linking — with all backend calls going to api.juancoin.cash (first-party). No obfuscation, remote code loading, or exfiltration of browsing data was observed. However, two concrete defects were found: (1) the bundled manifest declares an `alarms` permission that is absent from the live CWS public manifest, concealing the extension's persistent background polling from the store listing; and (2) a Google OAuth client secret is hardcoded in plain JavaScript. These defects, combined with a very poor publisher reputation (75% of the publisher's other extensions are flagged as malicious) and the extension being brand-new with a recent update, prevent a clean clearance — third-party risk and ML signals corroborate caution, and publisher reputation strongly contradicts the low ML score of 0.16.

JUAN - The Community Driven Crypto Extension

JUAN - The Community Driven Crypto Extension Chrome extension security report

ID: hpcbgfolhlankinnjbpkmahmllildajf

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
1.0.7
Size
0.87 MB
Rating
5.0/5
Reviews
5
Users
12
Type
Extension
Updated
Jun 27, 2026
Category
Just for fun
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
This publisherTrack record
4extensions
3 no longer listed

Publisher Contextual Analysis

Author
Juan
Country
MX
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Address
Puebla 204 Ciudad de México, CDMX 06700 MX
Website
Visit
Extensions
4
Active
1
Obsolete
3
Listed
4
Unlisted
0
Users
273

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3

Install growth

Item
Type
Severity
Description
identity
Permission
High
This permission accesses Chrome identity service and user information. Rated High because it can obtain OAuth tokens, access connected accounts, and impersonate the user in authenticated service.
downloads
Permission
High
This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
https://oauth2.googleapis.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.googleapis.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://x.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://api.juancoin.cash/*
Host
Medium
Host permission — access limited to this URL pattern.
https://juancoin.cash/*
Host
Medium
Host permission — access limited to this URL pattern.
https://news.google.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://api.alternative.me/*
Host
Medium
Host permission — access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: https://oauth2.googleapis.com/*, https://www.googleapis.com/*, https://news.google.com/*
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.
  • 2 medium

The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.

2 medium-severity findings in this extension’s code

2 medium
23 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

About this extension

Join a powerful community that drives the future of crypto in 1 extension.

Read the publisher’s full description

JUAN — The Always Evolving Community Crypto Extension JUAN is not just another crypto tool. It is an extension built by Juan himself alongside his community. Every feature, every update, and every decision is shaped by the people who use it. This is crypto the way it was meant to be — decentralized, transparent, and driven by you. Community at the Core JUAN exists because of its users. From day one, the direction of this extension has been guided by the voices of the people who rely on it. There is no boardroom making decisions behind closed doors. There is no corporate roadmap disconnected from what users actually need. The community proposes, the community votes, and the community builds. When you install JUAN, you are not just downloading software, you are joining a movement of crypto enthusiasts who believe that the best tools are the ones shaped by the people who use them every day. Our community spans traders, holders, developers, and newcomers alike. Whether you have been in crypto since the early days of Bitcoin or you are just getting started, your voice carries equal weight. We believe that diversity of perspective leads to better products, and JUAN is proof of that. Features that exist today came directly from user suggestions. Bugs that got fixed were reported by community members who care about making JUAN better for everyone. Earn Rewards Just by Using It Your time and attention have value. JUAN recognizes that. By actively using the extension, you earn rewards that go beyond just tracking your portfolio. The more you engage, the more you can earn when JUAN becomes something valuable. Rewards are distributed fairly and transparently. There are no hidden algorithms deciding who gets what. The reward system is designed to be straightforward — use JUAN, contribute to the community, and you are rewarded for it. This is not a gimmick or a short-term promotion. Rewards are a fundamental part of the JUAN ecosystem because we believe the people who make a product successful should share in that success. Every interaction matters. Checking your portfolio, exploring new coins, participating in community discussions — it all counts. JUAN tracks your engagement and ensures that active members are recognized and rewarded accordingly. The system is built to be sustainable, ensuring that rewards remain meaningful over time rather than diminishing as the user base grows. Governance by the Users In JUAN, governance is not a buzzword, it is a practice. Users have direct say in how the extension evolves. Feature requests are submitted by the community and voted on by the community. The features with the most support get built first. It is democracy applied to software development. This governance model ensures that JUAN always reflects what its users actually want. There is no disconnect between the people building the tool and the people using it, because they are the same people. When a majority of users want a specific feature, that feature gets prioritized. When the community identifies a problem, the community drives the solution. Governance extends beyond just features. Users have input on the direction of the project, the allocation of resources, and the values that guide development. This level of transparency and participation is rare in software, but it is central to everything JUAN stands for. We believe that when users have real ownership over a product, the result is something genuinely useful — not just something designed to extract value from them. Always Evolving Based on Your Feedback JUAN is never finished. It is a living product that grows and adapts based on what its users need. Every piece of feedback is read, considered, and acted upon. Whether it is a small quality-of-life improvement or a major new feature, user feedback is the engine that drives development. We ship updates regularly because we listen constantly. The feedback loop between users and development is tight and responsive. You do not submit a suggestion and wait months wondering if anyone saw it. You submit a suggestion and watch it move through the pipeline — discussed, prioritized, built, and shipped. This transparency in the development process is something we take seriously. The crypto landscape changes fast. New coins emerge, markets shift, and user needs evolve. JUAN keeps pace because its development is driven by the people who are closest to those changes — its users. When the market demands new tools, JUAN adapts. When users discover better ways to track and manage their portfolios, JUAN incorporates those insights. This is not a static tool that becomes outdated. It is an extension that grows with you. Simple Yet Effective Crypto can be overwhelming. Between the jargon, the volatility, and the sheer number of tools available, it is easy to feel lost. JUAN cuts through the noise. The interface is clean, intuitive, and focused on what matters — giving you the information you need without burying it under unnecessary complexity. Every element of the design serves a purpose. The portfolio view gives you an instant snapshot of your holdings. Price data is presented clearly with real-time updates. Charts are readable at a glance. There are no cluttered dashboards, no confusing navigation trees, and no features that exist just to pad a feature list. JUAN does what it does well, and it does not try to do everything. This simplicity is intentional and hard-earned. It takes more effort to build something simple than something complex. Every feature in JUAN has been refined through community feedback to ensure it is as intuitive as possible. New users can be up and running in seconds. Experienced users appreciate that nothing gets in their way. The result is a tool that feels effortless to use while still delivering everything you need to stay on top of your crypto portfolio. Effectiveness is not about having the most features. It is about having the right features, implemented well. JUAN tracks real-time prices, displays interactive charts, shows live data on X.com, and provides market sentiment through the Fear and Greed Index. Each of these features was requested by users, built with care, and refined based on feedback. Nothing is there by accident. What You Get with JUAN - Real-time price tracking for the coins you care about - A clean portfolio view that shows your total holdings at a glance - Interactive price charts with multiple timeframes - Live crypto prices displayed directly on X.com as you browse - Fear and Greed Index to gauge market sentiment - A retro pixel art aesthetic that stands out from generic crypto tools - An active community that shapes every update - Rewards for being an active user - Governance rights that give you a real voice in the product's future - Regular updates driven by community feedback - Lightweight and fast — no bloat, no lag Why JUAN Is Different Most crypto extensions are built by companies trying to monetize your data or push you toward their platform. JUAN is different because its incentives are aligned with its users. The community drives the product. Users earn rewards for participation. Governance ensures that no single entity controls the direction of development. This is not just an extension — it is a community-owned tool that puts its users first. The retro pixel art design is more than just an aesthetic choice. It reflects the ethos of the project — approachable, fun, and unapologetically different. In a space full of sleek, corporate-looking tools that all blend together, JUAN stands out. It reminds you that crypto started as a grassroots movement, and JUAN carries that spirit forward. Get Started Install JUAN, add your coins, and join a community that is building something meaningful. Your portfolio tracker is just the beginning. Your voice, your feedback, and your participation are what make JUAN what it is. This extension belongs to its users, and that includes you.

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

URLs
23

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found
No IP addresses found

2 medium-severity findings in this extension’s code

2 medium
23 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe
Version
Size
Verdict
Findings
Permhash
1.0.7
Latest
0.87 MBCaution0
55702c007231f591b860b396ec451c049b95acff8aefd72ceb12ec843dd78684
1.0.4
0.11 MBNot scanned—
d59266d853dd380104f8af52f0bfe4aa7739e8cbc091752989a793bd844ddb32
1.0.3
0.11 MBNot scanned—
d59266d853dd380104f8af52f0bfe4aa7739e8cbc091752989a793bd844ddb32
1.0.2
0.11 MBNot scanned—
d59266d853dd380104f8af52f0bfe4aa7739e8cbc091752989a793bd844ddb32
Showing 1 to 4 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

Store rankings

Where this extension appears in store category, collection and keyword rankings.