Chrome Web StoreNo malware found
In code review (v4.5.97)
Our reviewer read version 4.5.97 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.
891 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
ZenHub for GitHub, used by 50,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 2 findings (1 high, 1 medium), led by code injection. It comes from a trusted publisher and was last updated in October 2026.
Key findings
- High
Code Injection
The background script listens for a 'code' command and executes the provided string as a content script via chrome.scripting.executeScript without sanitization. This allows arbitrary code injection into any page matching the extension's host permissions. While likely used for legitimate page-script injection, the absence of input validation constitutes a dangerous practice and could be exploited if the content script is compromised. The required 'scripting' permission is not declared, which may cause this code to fail or indicate a leftover development path.
- Medium
Other
The video embed template takes a 'url' query parameter and injects it directly into an iframe src without validation. An attacker could craft a URL that redirects a user to a malicious page or loads undesired content. Since the template is listed in web_accessible_resources, any website can link to it, potentially enabling phishing or drive-by attacks. The intended use is to embed tutorial videos, so the URL should be restricted to trusted domains.
Analyst notes
ZenHub for GitHub is a well-established project management extension that integrates with GitHub. The permissions (storage, [domain withheld], [domain withheld], [domain withheld]) are necessary for its functionality. Network requests to [domain withheld], [domain withheld], Sentry, and Mixpanel are consistent with disclosed data-collection categories (user activity, website content, etc.) and purposes. The ML model's regex hits (xmlhttprequest, innerHTML, etc.) are typical for a DOM-manipulating GitHub enhancer. No stealthy exfiltration or malicious behavior found. Two minor code-quality findings (unsafe URL parameter in video embed and a dangerous executeScript code command) exist but do not indicate malice.
ZenHub for GitHub Chrome extension security report
ID: ogcgkffhplmphkaahpmffcafajaocjbd
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://zenhub.com
- Privacy
- Privacy Policy
- Help
- Help Center
- Country
- CA
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- 565 Great Northern Way Suite 600 Vancouver, BC V5T 0H8 CA
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
Sensitive Domain Access
This extension has access to the following sensitive domains:
- *://github.com/*
- *://api.github.com/*
891 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Zenhub – Project Management Inside GitHub
Read the publisher’s full description
Zenhub is the only project management tool that integrates natively within GitHub’s user interface. No lengthy onboarding. No configuration headaches. No separate logins. Developers stay in an environment they love, and Project Managers get total visibility into the development process. Over 8000 software teams trust Zenhub’s powerful browser extension to help them ship better software. Visualize Issues & Track Dependencies - Multi-Repo Task Boards allow you to track and provide transparency into your development process using existing GitHub data. Drag and drop Issues between pipelines, filter by labels, assign Issues, view Issues linked with Pull Requests, visualize blockers with Issue dependencies, and much more. Plan Sprints & Epics - Epics let you group multiple GitHub Issues together for better planning and tracking and collaborating on product backlogs. Use GitHub Milestones to create sprints, then add story points to track progress. Actionable Reports - Release Reports, Velocity Tracking, and Burndowns all enable more accurate predictions and continuous improvement insights. Determine team pace and efficiency, detect trends to improve processes, and measure the value delivered to end-users. Not using Chrome or Firefox? Learn more about accessing Zenhub across all browsers and mobile devices at https://zenhub.com/web Have any questions? Don't hesitate to tweet (@ZenhubHQ) or email us (support@zenhub.com). By signing up, you agree to Zenhub’s Terms of Service and Privacy Policy Privacy Policy: https://www.zenhub.com/privacy-policy Terms of service: https://www.zenhub.com/terms-of-service
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
891 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
Popular in productivity/workflow
- ClassLink OneClick Extension14,000,000 users
- Clever13,000,000 users
- Screencastify - Screen Video Recorder9,000,000 users
- Volume Booster5,000,000 users
- Gopher Buddy4,000,000 users