Let's Compare - Same Product Less Money!

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The Let's Compare extension declares itself as a shopping price comparison tool, and its technical behavior aligns with this purpose. The extension requests the tabs permission (MANIFEST-SENSITIVE-PERM-TABS in manifest.json), which is necessary for a shopping assistant to read product information from the current page.

The 135 IoC findings are overwhelmingly false positives from the XIOC extractor. The finding XIOC-DOMAIN-e.target in extracted_from_files is clearly a JavaScript property access chain (event.target), not a domain—the extractor misinterprets dot-separated property chains as domain names. This is a documented false positive pattern. Other IoCs like item.link, itemdata.shop, and productdata.name appear to be shopping-related service domains that would be legitimate for a price comparison extension to query.

Network findings show fetch calls in src/bg/background.js:101, src/bg/background.js:215, src/inject/inject.js:187, src/inject/inject.js:1504, and src/inject/inject.js:1955. These are expected for an extension that fetches product comparison data from external services. The 36 code-smell findings are low-severity patterns that match basic JavaScript constructs and do not indicate malicious intent.

Critically, there are ZERO malware signatures, ZERO obfuscation findings, and no credential theft indicators. The extension does not impersonate any known brand (no typosquatting), does not hijack browser settings, and does not exhibit proxyware behavior. The developer email [email protected] is generic but not obviously malicious, and the extension has 415 users with version 2.0.5 indicating active maintenance.

The strongest counterargument would be that some domains like selectedgeo.name and state.activeproduct.shop are not well-known infrastructure providers and could indicate data exfiltration. However, for a shopping comparison extension, connecting to product data services is expected behavior. Without malware signatures, obfuscation, or evidence of deceptive practices, these domains alone do not establish malicious intent. The high finding count (179 total) is driven by IoC volume and code-smell patterns, which the scoring system is known to inflate disproportionately.

This extension's technical profile matches its stated purpose: reading page content via tabs permission, fetching comparison data via network calls, and no evidence of credential theft, hijacking, or malware delivery.

Key Reasons

• Zero malware signatures and zero obfuscation findings
• XIOC-DOMAIN-e.target is clearly a JavaScript property access chain false positive
• Extension behavior matches stated shopping comparison purpose
• tabs permission is legitimate for page content reading
• No typosquatting or browser hijacking indicators

False Positive Considerations

• XIOC property access chains misread as domains (e.target)
• High IoC count from extractor noise
• Code-smell findings on basic JavaScript patterns
• Shopping-related service domains flagged as suspicious

Reviewed 2026-05-09; recommended action: suppress false positive; model confidence 75%.