Chrome Web Store

104Versions

1Code reviewed

No malware found

In code review

Our reviewer read this extension’s code and found no malicious behaviour. An automated risk flag was reviewed and overturned.

349 indicators in this extension

349 indicators

1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99 Start 7-day trial — all reports

One-time payment · Secure checkout by Stripe

What our analysis found

Scratch Addons, used by 500,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can observe network requests. It comes from a trusted publisher and was last updated in April 2026.

Analyst notes

All permissions are used solely for enhancing scratch.mit.edu. Network requests go only to Scratch APIs and the publisher's own site ([domain withheld]), with no third‑party data exfiltration. The extension is a well‑known open‑source project with a large, satisfied user base, high ratings, and a trusted publisher. The ML model's low score (0.00) and the clean permhash cluster further corroborate that this is a false positive.

Scratch Addons Chrome extension security report

ID: fbeffbjdlemaoicjdapfpikkikjoneco

Supported Languages

🇧🇷Brazilian Portuguese

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇳🇱Dutch

🇺🇸English

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇮🇳Hindi

🇭🇺Hungarian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇻🇳Vietnamese

Extension Info & Metadata

Status

Active

Version

1.45.2

Size

3.58 MB

Rating

4.7/5

Reviews

848

Users

500,000

Type

Extension

Updated

Apr 30, 2026

Publisher Contextual Analysis

Trusted

Author: scratchaddons.com
Privacy: Privacy Policy
Help: Help Center
MX records exist: No
Domain exists: No
Is disposable: No
Is role-based: Yes
Mailbox exists: No
Website: Visit

Extensions

Active

Obsolete

Listed

Unlisted

Users

500,000

Screenshots & videos

Install growth

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

See plans

React Flow

Internal permhash`865327a221…`
No malicious matches

1 other extension carries this fingerprint, none of them known malicious.

Withheldnot flagged

Permhash (Mandiant)`374be184e9…`
No malicious matches

1 other extension carries this fingerprint, none of them known malicious.

Withheldnot flagged

Network indicators

341 URLs and 2 IP literals were extracted from this version.

Item	Type	Severity	Description
webRequest	Permission	Critical	This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
declarativeNetRequestWithHostAccess	Permission	Critical	This permission combines network request modification with host permissions. Rated Critical because it can modify requests for specific domains, potentially targeting sensitive websites with precise attack rules.
cookies	Permission	High	This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 10% increase: Early script execution enables pre-emptive content manipulation
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
https://scratch.mit.edu/*	Host	Medium	Host permission — access limited to this URL pattern.
https://api.scratch.mit.edu/*	Host	Medium	Host permission — access limited to this URL pattern.
https://clouddata.scratch.mit.edu/*	Host	Medium	Host permission — access limited to this URL pattern.
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.
contextMenus	Permission	Low	This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content.
alarms	Permission	Low	This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

Each row lists a threat category the scanner evaluates. A checkmark means the review ran and found no matching issues in that category for this version.

Data Exfiltration
Code review completed; no malicious patterns detected for this category.
Unauthorized Data Collection
Code review completed; no malicious patterns detected for this category.
Network Interception
Code review completed; no malicious patterns detected for this category.
Code Injection
Code review completed; no malicious patterns detected for this category.
Credential Theft
Code review completed; no malicious patterns detected for this category.
Obfuscation
Code review completed; no malicious patterns detected for this category.
Tracking
Code review completed; no malicious patterns detected for this category.
Privilege Escalation
Code review completed; no malicious patterns detected for this category.
Phishing
Code review completed; no malicious patterns detected for this category.
Remote Code Loading
Code review completed; no malicious patterns detected for this category.
Other
Code review completed; no malicious patterns detected for this category.

349 indicators in this extension

349 indicators

1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99 Start 7-day trial — all reports

One-time payment · Secure checkout by Stripe

About this extension

Scratch Addons provides customizable features and themes for the scratch.mit.edu website and project editor.

Read the publisher’s full description

Choose from 100+ options: • Quickly read and respond to messages by clicking the extension icon. • Jump into active multiplayer games with the cloud games tab. • Beautify every page on the Scratch website with the 3.0 style and options for dark mode and custom color themes. • Easily leave studios, promote or remove curators, and browse followers to invite. • Improve project management with the My Stuff search bar and the unshare button. • Enhance the project player with a pause button, 60FPS, and gamepad support. • Animate more easily with onion skinning, exact color picking, and costume search. • Supercharge your coding efficiency with block search, searchable dropdowns, block switching, single-grab, and copy/paste. • Stay tidy with the auto-hiding block palette and sprite folders. • Directly set and freeze project thumbnails to any image or GIF. • Bring back the cat blocks from April Fools. • Debug projects with logging, performance monitoring, and step-by-step execution. • And more with each update! This extension is open source software licensed under GPL v3. To contribute or check the source code: https://github.com/ScratchAddons For more information, go to: ScratchAddons.com This project is not affiliated, associated, or in any way officially connected with the Scratch website or the organizations that maintain it.

User reviews

4.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

it adds all the features i only pondered and dreamed about to scratch

Scgamer·27 Sept 2026

Worked for me for 1 1/2 years before completely not working. WAS very useful, however kept on corrupting. Also, after reinstalling countless times, it still corrupts and after this last reinstall it now doesn't work. Farewell scratch addons.

phxpw3118·20 Sept 2026

peak

МС

Магомед Селимов·6 Sept 2026

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

URLs

341

IPv4

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found

No IP addresses found

349 indicators in this extension

349 indicators

1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99 Start 7-day trial — all reports

One-time payment · Secure checkout by Stripe

Version	Size	Verdict	Findings	Permhash
1.45.2 Latest	3.58 MB	No malware found	0	374be184e9acf19f7b4e2da1b99054a681f167cb29a26d1ba14fdf1d0cf42b63
1.45.1	3.58 MB	Not scanned	—	374be184e9acf19f7b4e2da1b99054a681f167cb29a26d1ba14fdf1d0cf42b63
1.45.0	3.58 MB	Not scanned	—	374be184e9acf19f7b4e2da1b99054a681f167cb29a26d1ba14fdf1d0cf42b63
1.44.5	3.20 MB	Not scanned	—	374be184e9acf19f7b4e2da1b99054a681f167cb29a26d1ba14fdf1d0cf42b63
1.44.4	3.20 MB	Not scanned	—	374be184e9acf19f7b4e2da1b99054a681f167cb29a26d1ba14fdf1d0cf42b63
1.44.3	3.20 MB	Not scanned	—	374be184e9acf19f7b4e2da1b99054a681f167cb29a26d1ba14fdf1d0cf42b63
1.44.2	3.20 MB	Not scanned	—	374be184e9acf19f7b4e2da1b99054a681f167cb29a26d1ba14fdf1d0cf42b63
1.44.1	3.20 MB	Not scanned	—	374be184e9acf19f7b4e2da1b99054a681f167cb29a26d1ba14fdf1d0cf42b63
1.44.0	3.19 MB	Not scanned	—	374be184e9acf19f7b4e2da1b99054a681f167cb29a26d1ba14fdf1d0cf42b63
1.43.0	3.52 MB	Not scanned	—	374be184e9acf19f7b4e2da1b99054a681f167cb29a26d1ba14fdf1d0cf42b63

Showing 1 to 10 of 110 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

Popular in Tools

迅雷下载支持80,000,000 users
Claude18,000,000 users
Passlit Openbook10,000,000 users
Zotero Connector9,000,000 users
WPS PDF - Read, Edit, Fill, Convert, and AI Chat PDF with Ease8,000,000 users

No malware found

349 indicators in this extension

What our analysis found