Chrome Web Store
38Versions
0Code reviewed

Not reviewed

No code review on record

We have not reviewed this extension’s code, so we cannot vouch for it either way. Check the permissions below to decide whether it asks for more than it needs.

Want us to read this extension's code? Ask for a review and we'll queue it.

890 indicators in this extension

890 indicators
0 versions analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

What our analysis found

Pali Wallet, used by 5,000 people, is not yet reviewed by Extension Auditor. Its permissions mean it can inject scripts into pages. It was last updated in February 2026.

Pali Wallet

Pali Wallet Chrome extension security report

ID: mgffkfbidihjpoaomajlbgchddlicgpn

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
4.0.0
Size
2.57 MB
Rating
4.9/5
Reviews
54
Users
5,000
Type
Extension
Updated
Feb 13, 2026
Category
Tools
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
This publisherTrack record
1extension
All still listed

Publisher Contextual Analysis

Author
pali@syscoin.org
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Users
5,000

Email Change History

3 changes
Aug 14, 2025
Domain changed
Sep 13, 2025
Sep 16, 2025

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5

Install growth

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
http://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
https://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
hid
Permission
High
This permission grants access to human interface devices. Rated High because it can read raw input from keyboards, security keys and other HID hardware.
clipboardWrite
Permission
High
This permission allows modification of clipboard content. Rated High because it can inject malicious content into the clipboard, modify copied passwords, and manipulate copied data.
offscreen
Permission
High
This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact• 10% increase: Early script execution enables pre-emptive content manipulation
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
*://connect.trezor.io/9/*
Host
Medium
Host permission — access limited to this URL pattern.
http://localhost:8545/
Host
Medium
Host permission — access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: *://connect.trezor.io/9/*
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.

890 indicators in this extension

890 indicators
0 versions analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

About this extension

A Non-Custodial Crypto Wallet

Read the publisher’s full description

Unlock the limitless potential of the blockchain with Pali Wallet, the official Syscoin & Rollux browser extension wallet. As the only crypto wallet that seamlessly integrates with both EVM chains and Bitcoin-like chains for dApps, Pali unlocks a unique breadth of features and functionality. Pali Wallet v2 enables you to securely store, send, and receive digital assets, BTC, as well as any tokens built on the Syscoin LUX Token Platform, including NFTs and fungibles. In this release, the extension also supports all EVM tokens, expanding its capabilities to provide seamless interaction with a broader range of digital assets. Pali supports ERC20, ERC721, and ERC1155 tokens, and offers native multi-chain functionality that allows users to add custom blockchains. This robust feature set is accompanied by the simplicity, cleanliness, and security that define Pali Wallet. We believe in the right to privacy, so Pali does not and will never collect any personal information from users. This non-custodial web 3.0 wallet provides you the ability to authenticate and sign transactions without exposing your private keys. Your keys are kept secure in the extension's storage area and are encrypted with a password. Leverage smart cold wallets via Trezor™ hardware wallet compatibility or via a secret 12-word recovery phrase, which makes it easy for you to restore your wallet. Remember, don't forget your phrase, and keep it safe and secret! For dApp developers, we offer a simple API that facilitates integrating solutions with the Syscoin blockchain and other EVM-based blockchains through the extension. The API guide is available here: https://docs.paliwallet.com/guide/ Please, note that the docs are currently outdated and will be updated soon to properly explain how to integrate with Pali through the API guide. By complying with the EIP-1193: Ethereum Provider JavaScript API standard, developers can seamlessly integrate via the window.ethereum object. For Syscoin Core, Pali leverages the open-source library sysweb3 (https://github.com/pollum-io/sysweb3), alongside a fully custom, optimized implementation of a UTXO interface for content script (window.pali). Pali is fully open-source and audited, which means you can check everything for yourself. We're maintained by talented developers who work closely with our community, so users are able to build future versions alongside our team. You will soon be able to seamlessly use your Pali Wallet across Web and Mobile devices. Are you ready to unlock the full potential of the blockchain? Join the users who have discovered the power of Pali Wallet and click the “Add to Chrome” button to install Pali Wallet now! Pali Wallet is powered by Pollum Labs in cooperation with Syscoin Foundation. The source code is available here: https://github.com/syscoin/pali-wallet. Be part of the future, be part of Pali! 🕉️

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

URLs
882
IPv4
8

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found
No IP addresses found

890 indicators in this extension

890 indicators
0 versions analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe
Version
Size
Verdict
Findings
Permhash
4.0.0
Latest
2.57 MBNot scanned—
fc28b15ad00f267d7f3030099c477b655dce333d6e055857e0add113a3890b61
3.2.0
37.17 MBNot scanned—
ecb6bec02490d03d82f8e102d5c6a61f20e11f1c32a5a9ba597f4cc601f4f163
3.1.0
37.14 MBNot scanned—
ecb6bec02490d03d82f8e102d5c6a61f20e11f1c32a5a9ba597f4cc601f4f163
3.0.0
37.09 MBNot scanned—
ecb6bec02490d03d82f8e102d5c6a61f20e11f1c32a5a9ba597f4cc601f4f163
2.0.22
46.98 MBNot scanned—
7153297b6b9c64fcdd754ace82d5c55d9a724c80c7f624dc611e7337c069e74a
2.0.21
47.34 MBNot scanned—
7153297b6b9c64fcdd754ace82d5c55d9a724c80c7f624dc611e7337c069e74a
2.0.20
46.98 MBNot scanned—
7153297b6b9c64fcdd754ace82d5c55d9a724c80c7f624dc611e7337c069e74a
2.0.19
47.34 MBNot scanned—
7153297b6b9c64fcdd754ace82d5c55d9a724c80c7f624dc611e7337c069e74a
2.0.18
46.98 MBNot scanned—
7153297b6b9c64fcdd754ace82d5c55d9a724c80c7f624dc611e7337c069e74a
2.0.16
46.68 MBNot scanned—
7153297b6b9c64fcdd754ace82d5c55d9a724c80c7f624dc611e7337c069e74a
Showing 1 to 10 of 40 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

Popular in Tools

Store rankings

Where this extension appears in store category, collection and keyword rankings.