What our analysis found

Shodan, used by 100,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 medium), led by other. It comes from a trusted publisher and was last updated in March 2025.

Key findings

• medium· other —The bundled manifest uses Manifest Version 2 and lists fewer host permissions than the live Chrome Web Store published manifest (which indicates Manifest Version 3 and includes additional hosts like and). This discrepancy could be due to a version mismatch, but it should be investigated to ensure the published update does not introduce malicious behavior.

The extension's code is straightforward: it queries the Shodan API via hardcoded endpoints to display host information, consistent with its Privacy & Security category. All network requests go to (the publisher's domain) and no data exfiltration or tracking is present. The ML model's low risk score (0.00) aligns with this benign behavior; the only deviation is a manifest version and permissions mismatch between the bundled source (v2) and the live Chrome Web Store listing (v3), which likely reflects a recent update not included in this bundle.