Chrome Web Store
77Versions
1Code reviewed

No malware found

In code review (v2.1.0)

Our reviewer read version 2.1.0 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

44 indicators in this extension

44 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

What our analysis found

Truffle, used by 100,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 1 finding (1 high), led by other. It comes from a trusted publisher and was last updated in May 2024.

Key findings

  • High

    Other

    The published CWS manifest lists host_permissions as [domain withheld] and [domain withheld], plus additional permissions (unlimitedStorage, gcm, notifications, declarativeNetRequestWithHostAccess) not present in this bundled version. This discrepancy could mean the live extension has much broader capabilities, posing a risk of unauthorized data access or abuse. Users should verify the installed version matches expectations.

Analyst notes

Code analysis shows benign functionality: enhancing livestreams with emotes, badges, theatre mode, etc. Network requests go to publisher-controlled domains ([domain withheld], zygote.spore.build) and align with disclosed data collection categories (authentication info, PII). However, the published CWS manifest differs significantly from the bundled manifest (adds broad host permissions to all URLs, plus gcm, notifications, declarativeNetRequest). This mismatch could indicate a later, more invasive update, lowering confidence.

Truffle

Truffle Chrome extension security report

ID: bkkjeefjfjcfdfifddmkdmcpmaakmelp

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status
Active
Version
4.7.1
Size
0.10 MB
Rating
4.3/5
Reviews
731
Users
100,000
Type
Extension
Updated
May 22, 2024
Category
Social networking
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
2extensions
All still listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
Spore Labs, Inc.
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Website
Visit
Extensions
2
Active
2
Obsolete
0
Listed
2
Unlisted
0
Users
103,000

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3

Install growth

Item
Type
Severity
Description
declarativeNetRequestWithHostAccess
Permission
Critical
This permission combines network request modification with host permissions. Rated Critical because it can modify requests for specific domains, potentially targeting sensitive websites with precise attack rules.
http://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
https://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
cookies
Permission
High
This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 10% increase: Early script execution enables pre-emptive content manipulation
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
gcm
Permission
Medium
This permission enables Google Cloud Messaging for push notifications. Rated Medium because it can maintain persistent connections, receive external messages, and operate in the background.
Early Content Script Execution
Risk Factor
Medium
This extension runs content scripts at document_start.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.

44 indicators in this extension

44 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

About this extension

Enhance your livestream viewing experience

Read the publisher’s full description

Enhance your viewing experience on YouTube Live and Twitch! This extension adds familiar emotes to live chat, allows you to set your username and name color in chat, participate in predictions, cheer on other creators with raids, unlock rewards in the battle pass, and helps you find livestreams more easily. How to use: • Install and visit an enabled livestream to begin using the extension. • Chat settings can be configured in the settings menu by clicking on the extension icon in the YouTube header. • Name color and display name can be configured in the extension widget under the settings cog. • Turn on 'Experimental' mode to test out new features before they're ready for everyone. Note: The chat styles and theater mode are available for all channels but channel points and prediction are currently only available to a small subset of creators and we are actively rolling out to creators on our waitlist. If you'd like to get Truffle.TV for your livestream reach out here: https://truffle.vip Truffle (experimental mode) also gets you merch discounts on certain creators' stores, better rewards for being a Patron, and more :) Keep an eye on our Twitter for updates: https://twitter.com/trufflevip Formerly known as Mogul.TV and Truffle.TV

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

URLs
37
IPv4
2

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found
No IP addresses found

44 indicators in this extension

44 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe
Version
Size
Verdict
Findings
Permhash
4.7.0
Latest
0.10 MBNot scanned—
ceade27785a72e37b58347da352a5aed3b8faeae5cb6644d9e274125ee48fab6
4.6.0
0.09 MBNot scanned—
ceade27785a72e37b58347da352a5aed3b8faeae5cb6644d9e274125ee48fab6
4.5.2
0.09 MBNot scanned—
ceade27785a72e37b58347da352a5aed3b8faeae5cb6644d9e274125ee48fab6
4.5.1
0.10 MBNot scanned—
ceade27785a72e37b58347da352a5aed3b8faeae5cb6644d9e274125ee48fab6
4.4.17
0.15 MBNot scanned—
ceade27785a72e37b58347da352a5aed3b8faeae5cb6644d9e274125ee48fab6
4.4.16
0.15 MBNot scanned—
ceade27785a72e37b58347da352a5aed3b8faeae5cb6644d9e274125ee48fab6
4.4.15
0.15 MBNot scanned—
ceade27785a72e37b58347da352a5aed3b8faeae5cb6644d9e274125ee48fab6
4.4.14
0.15 MBNot scanned—
ceade27785a72e37b58347da352a5aed3b8faeae5cb6644d9e274125ee48fab6
4.4.13
0.15 MBNot scanned—
ceade27785a72e37b58347da352a5aed3b8faeae5cb6644d9e274125ee48fab6
4.4.11
0.15 MBNot scanned—
ceade27785a72e37b58347da352a5aed3b8faeae5cb6644d9e274125ee48fab6
Showing 1 to 10 of 80 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.

More from Spore Labs, Inc.

Popular in Social Networking