Chrome Web StoreCaution required
Suspicious in code review (v3.3)
Our reviewer found behaviour consistent with malware in version 3.3, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
東カレ自動化拡張機能 is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by other. It comes from a publisher with 3 extensions and was last updated in October 2026.
Key findings
- High
Other
The bundled manifest requests 7 permissions (tabs, storage, webNavigation, notifications, identity plus activeTab and scripting) and broad `<all_urls>` host access, whereas the published CWS manifest lists only `activeTab` and `scripting` with a narrow host pattern (`[domain withheld]). This discrepancy means users and Google's review process see a much less privileged extension than what is actually installed, constituting a deliberate misrepresentation of the extension's true permission scope.
- Medium
Other
The background service worker injects a script into every completed page load across all domains (enabled by the `<all_urls>` host permission) to retrieve `window.location.href`, even though `details.url` is already provided by the `webNavigation.onCompleted` callback without needing script injection. While the injected code only reads the URL, this pattern silently runs content in every tab the user visits — broader than the extension's stated [domain withheld] scope and unnecessary given the available API.
Analyst notes
The bundled manifest declares 7 permissions including `tabs`, `storage`, `webNavigation`, `notifications`, `identity`, and `<all_urls>` host access, while the published CWS manifest declares only `activeTab` and `scripting` with a narrow host permission (`[domain withheld]). This is a significant permission misrepresentation that hides the true scope of access from the store review. The core functionality (dating-app automation with facial recognition and ChatGPT-assisted replies) is consistent with the described purpose, and all data flows go to the publisher's own backend (`[domain withheld]`); the third-party risk score corroborates concern (extension removed from store), while publisher reputation and first-party data destinations partially counterbalance the ML signal.
東カレ自動化拡張機能 Chrome extension security report
ID: pnndcaiifdokjgageemcdinanflffhhb
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- raito
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
No Security Analysis Available
Security analysis has not been performed for this extension version yet.
About this extension
マッチングアプリ東カレデートにおいてDM送信・バラ送信・メッセージ送信等を自動化するツール
Read the publisher’s full description
ナギコンサル受講生専用のバラDM自動化のための拡張機能です。 一般に公開する予定はなく、特定の悪用しない信頼ができる少数の人に限定して公開します。 マッチングアプリ東カレデートにおいて、好みのタイプの写真を入力するとそれに類似した相手にバラとdmを送ります。 機能は随時アップデートしていきます。
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from raito
- pairs自動返信ツール8 users
- with自動返信ツール5 users
Popular in productivity/communication
- Fathom AI Note Taker for Google Meet600,000 users
- Seznam Doplněk – Email200,000 users
- Ad Speedup - Skip Video Ads 16X Faster200,000 users
- MailTracker: Email tracker for Gmail200,000 users
- Superhuman Mail100,000 users