Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Notepad - online, used by 100,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by unauthorized data collection. It comes from a trusted publisher and was last updated in July 2026.
Key findings
- High
Unauthorized Data Collection
One second after the service worker starts, the extension retrieves the user's KEYUSER tracking ID and `oldata` (note contents stored for offline users in lines 80-91) and sends both to [domain withheld] via JSON POST with method='keydata'. For users who chose offline mode (email='offline'), their locally-stored notes are silently uploaded; this endpoint and this collection are not disclosed in the CWS listing (declared: none) and [domain withheld] is not in declared host_permissions (only [domain withheld] without subdomain wildcard).
- Medium
Tracking
On every background-script load, the extension generates or retrieves a 25-char random string concatenated with the browser's navigator.language, stores it permanently as KEYUSER, and issues a GET beacon to [domain withheld]>. This is an undisclosed persistent cross-device tracking identifier; the CWS listing declares no data collection.
Analyst notes
contains two undisclosed data-collection mechanisms: (1) a persistent random tracking ID (KEYUSER) is generated on first run and transmitted to [domain withheld] on every background script load; (2) for users in 'offline' mode, their note contents are stored as `oldata` and silently POST-ed to [domain withheld] — an endpoint not declared in host_permissions and whose collection is not disclosed in the CWS listing (declared: none). The publisher's domain ([domain withheld]) is the destination, so this is first-party rather than a third-party exfiltration, but the combination of undisclosed collection, four publisher changes, and an internal IoC flag (MalExt Sentry, 2026-04-09) corroborate suspicion; the third-party score's 'privacy-policy-url-invalid' flag and the IoC contradict the ML's relatively low score.
Notepad - online Chrome extension security report
ID: fefodpegbocmidnfphgggnjcicipaibk
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- ad
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Email Change History
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
- 1 high
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Notepad-online for Chrome with sync functionality. Open and edit data on any computer.
Read the publisher’s full description
This is just a notepad online. You can save any text from the internet and get access to it anywhere. Notepad with auto save and sync. Create a large number of notes for different purposes. Enter the password, so nobody can see the content of your Notepad. Enjoy!
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from ad
- HeaderMaster Pro - HTTP Modifier: Headers, Redirects, and Payload injection26 users
- JSON Lens5 users
- TikTok Browser Downloader2 users
- ZeWork Chat1 users
- ZeWork for Education0 users
Popular in Workflow & Planning
- Adobe Acrobat: PDF edit, convert, sign tools343,000,000 users
- Application Launcher For Drive (by Google)98,000,000 users
- AdBlock — block ads across the web65,000,000 users
- Chrome Remote Desktop41,000,000 users
- Adblock Plus - free ad blocker40,000,000 users