Chrome Web StoreCaution required
Suspicious in code review (v1.0.2)
Our reviewer found behaviour consistent with malware in version 1.0.2, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
15 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Swift Solutions is rated caution by Extension Auditor. Our code review reported 5 findings (1 critical, 4 high), led by credential theft. Its permissions mean it can read and change data on all websites, can inject scripts into pages and can observe network requests.
Key findings
- Critical
Credential Theft
The user's authentication token (granting full access to their account on the operator backend) is appended as a plaintext URL query parameter when opening `[domain withheld]. This domain is not in the extension's declared backend list (`[domain withheld]`, `[domain withheld]`) and is a third-party Vercel-hosted service. URL query parameters are logged by server access logs, browser history, and referrer headers, exfiltrating live credentials to an undisclosed third party.
- High
Other
`clearBrowserData()` is invoked without a domain argument at line 741 (inside `openDatSessionWithData`). It calls `chrome.cookies.getAll({})` with an empty object, which returns every cookie from every domain in the browser. The loop then removes all of them. This silently logs the user out of every website they are signed into every time they click 'Open DAT', far exceeding the extension's stated scope of managing [domain withheld] session data.
- High
Code Injection
The backend endpoint ` ` returns an object with a ` ` field that is injected verbatim into the extension popup via `innerHTML` without any sanitization. The extension popup runs in a privileged context with access to all Chrome extension APIs. A compromised or malicious backend can deliver HTML containing event-handler attributes or script tags that execute arbitrary code with full extension privileges, enabling cookie theft, proxy manipulation, and tab control.
- High
Credential Theft
The extension downloads stored browser session cookies for a named session ID from the operator's backend server and then injects them into the browser (`injectCookies` at line 828). This means the operator holds [domain withheld] session credentials server-side and distributes them to extension users on demand, which constitutes centralized credential warehousing and session cloning. The same mechanism could be abused to inject cookies for any domain the backend chooses to serve, since the injection function is domain-agnostic.
- High
Network Interception
The extension fetches proxy credentials from `[domain withheld]` and sets a system-wide HTTP proxy for all browser traffic. The bypass list excludes Google and the operator's own API but routes all other traffic through an operator-controlled server. Because the proxy scheme is `http` (not HTTPS), the proxy server can observe and modify unencrypted traffic in plaintext, and because it applies to `<all_urls>` beyond [domain withheld], this is a man-in-the-middle position on the user's general browsing traffic whenever the extension is active.
Analyst notes
The extension is a tool for the DAT freight marketplace: it fetches stored DAT session cookies from its backend and injects them, routes all browser traffic through an operator-controlled HTTP proxy, and enforces paid-feature restrictions via CSS injection. Three concrete code-level findings elevate this beyond the extension's stated purpose: (1):716 appends the user's live auth token as a plaintext URL query parameter to `[domain withheld]`, a Vercel-hosted domain entirely separate from the declared backends (`[domain withheld]`, `[domain withheld]`); (2) `clearBrowserData()` in (called at line 741) calls `chrome.cookies.getAll({})` with no domain filter and removes every cookie in the browser—not just [domain withheld]—silently logging the user out of all sites; (3):680 injects backend-supplied HTML (`response.data. `) unsanitized via `innerHTML` into the extension popup, giving a compromised backend arbitrary code execution in the extension's privileged context. The 40% malware rate in the permhash cluster corroborates these findings; the publisher website points to a generic Chrome support page and the privacy policy is hosted on an unknown personal GitHub Pages account, both inconsistent with a legitimate enterprise tool.
Swift Solutions Chrome extension security report
ID: dfccmegcgoefkhnaeeodbakclihfipbo
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- RTN Global
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- 1209 Mountain Rd Pl NE ste r Albuquerque, NM 87110-7845 US
- Website
- Visit
Screenshots & videos
Install growth
Sensitive Domain Access
This extension has access to the following sensitive domains:
- *://script.google.com/*
- *://script.googleusercontent.com/*
- *://*.google.com/*
15 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Manage browser data efficiently
Read the publisher’s full description
Swift Solutions is a browser extension designed for organizations that need streamlined access to DAT platform services. The extension supports secure session management and provides authorized users with controlled access to DAT resources through an intuitive interface. Key Features: Secure DAT Session Management Access and manage DAT platform sessions with built-in authentication and session persistence. Multi-Browser Compatibility Works seamlessly across Chrome and Firefox browsers with consistent functionality. Cookie and Storage Management Efficiently handle browser cookies and local storage for optimal DAT platform performance. Real-Time Session Monitoring Monitor active DAT sessions and receive status updates directly in the browser. Administrative Controls Organization administrators can configure and manage extension settings and permissions. Privacy: All session operations occur locally within the user's browser with encrypted storage. No browsing history, personal data, or analytics are collected or transmitted. The extension operates independently without external data sharing or third-party tracking, ensuring complete privacy for organizational use.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
15 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from RTN Global
- DAT GO78 users
- DAT Ex Pro43 users
- Instant Annotator34 users
- Swift Solutions33 users
- SwiftSolutions7 users
Popular in Developer Tools
- GoFullPage - Full Page Screen Capture11,000,000 users
- touchenex 확장8,000,000 users
- SentinelOne7,000,000 users
- TrendAI™ Toolbar for Enterprise7,000,000 users
- React Developer Tools5,000,000 users