Chrome Web Store
4Versions
1Code reviewed

No malware found

In code review (v1.0.0)

Our reviewer read version 1.0.0 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

Twilio Dialpad showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages. It comes from a trusted publisher and was last updated in September 2026.

Analyst notes

The source code is a legitimate Twilio VoIP softphone built with React, Zod, Zustand, and the Twilio Voice SDK. All 20 POST requests catalogued by the ML model go exclusively to declared host_permissions — Twilio APIs during an automated Serverless setup flow (creating API keys, uploading 4 function files, triggering builds, deploying), plus live call traffic to Deepgram and HubSpot with the user's own API keys. The clipboardRead permission is used solely to detect phone numbers in the clipboard and pre-fill the dialer, which is canonical click-to-call UX. No obfuscation: the bundle is standard output with identifiable React license headers. The sole hygiene concern is that after each call, transcripts are automatically POSTed to `[domain withheld]}` (the publisher's own Claude AI coaching service) without an explicit per-session opt-in prompt beyond CWS data-collection disclosure; however, this destination is in host_permissions, the behaviour is described in the listing ('Connects to Claude AI'), and the data categories (PII, user activity, website content) are all CWS-disclosed. The ML score of 0.16 is fully explained by the large React+Twilio bundle, the multi-step Twilio provisioning POSTs, and two `fromCharCode` calls from minified library code.

Twilio Dialpad

Twilio Dialpad Chrome extension security report

ID: hnfigfmeamiepnpodpbheggbgcbnpaga

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
1.3.0
Size
0.22 MB
Rating
5.0/5
Reviews
4
Users
65
Type
Extension
Updated
Sep 29, 2026
Category
Communication
Price
Paid
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
This publisherTrack record
2extensions
All still listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
SaasByMohd
Country
IN
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Address
Jaipur National University Rd Ghati Karolan Jaipur, Rajasthan 302017 IN
Website
Visit
Extensions
2
Active
2
Obsolete
0
Listed
2
Unlisted
0
Users
110

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3

Install growth

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
clipboardRead
Permission
High
This permission allows reading clipboard content. Rated High because it can steal copied passwords, sensitive data, and monitor all content copied to clipboard.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk: • 19% increase: Access to sensitive domains increases potential impact
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
https://api.twilio.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://*.twil.io/*
Host
Medium
Host permission — access limited to this URL pattern.
wss://*.twilio.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://eventgw.twilio.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://serverless.twilio.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://serverless-upload.twilio.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://api.hubapi.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://app.hubspot.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://api.deepgram.com/*
Host
Medium
Host permission — access limited to this URL pattern.
wss://api.deepgram.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://dialler-mcp.vercel.app/*
Host
Medium
Host permission — access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: https://app.hubspot.com/*
sidePanel
Permission
Low
This permission adds custom panels to the browser interface. Rated Low because it only affects browser UI elements and cannot access page content.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.

About this extension

Browser-based Twilio dialpad — make and receive calls without a phone.

Read the publisher’s full description

Turn your browser into an AI-powered sales call station. Twilio Dialpad lets you make and receive international calls directly from Chrome — no desk phone, no separate app. Built for sales reps, SDRs, and business development teams who need a smarter way to handle calls. 🔥 WHAT IT DOES - Make + receive calls from any country via your Twilio account - Auto-transcribes every call in real time using Deepgram - Connects to Claude AI — ask "analyze my last call" and get instant coaching - Syncs call history to HubSpot CRM automatically - Works as a side panel — never leaves your browser 🤖 AI CALL COACHING (PRO) After every call, your transcript is sent to Claude AI via MCP. Open Claude.ai and ask: - "What did I do well on my last call?" - "Where did I lose the prospect?" - "Give me a script for my next call with this contact" Claude reads your actual call data — not generic advice. ⚡ SETUP IN 4 STEPS 1. Install extension 2. Connect your Twilio account (wizard guides you) 3. Copy your Claude connector URL from options page 4. Paste in Claude.ai → Settings → Integrations No config files. No coding. No desktop app required. 📦 WHAT YOU NEED - Twilio account (free trial works) - Deepgram API key (free tier: $200 credit included) - Claude.ai account (free tier works for basic analysis) 🎯 FREE TRIAL Every install gets 7 days of full Pro features — cloud sync + Claude MCP included. After trial: $9/month. Local calling always free. You own your Twilio account. --- Built for salespeople who want an unfair advantage on every call.

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

No network indicators were extracted from this version.

Version
Size
Verdict
Findings
Permhash
1.3.0
Latest
0.22 MBNot scanned—
20ab29edf97a818d8349b55341b244b3b79cdb1153fdb091be743f43457f30c3
1.2.0
0.74 MBNot scanned—
4c243c2efc9b9263f998ca367177b774f9a70f6022083478dc9d8c494bf66b5f
1.1.0
0.22 MBNot scanned—
4c243c2efc9b9263f998ca367177b774f9a70f6022083478dc9d8c494bf66b5f
1.0.0
0.21 MBNo malware found0
4c243c2efc9b9263f998ca367177b774f9a70f6022083478dc9d8c494bf66b5f
Showing 1 to 4 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

Gain full insight into all external connections.

Upgrade for full visibility.