Is "Delete X Tweets - Remove Twitter Posts" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-28. The review verdict is likely false positive with 85% confidence.

Recommended action: no action.
Risk context: MEDIUM risk, score 44/100.
Evidence context: threat category none; evidence quality moderate.

This extension presents a clean security profile with no evidence of malicious behavior. The six findings all originate from assets/content-script-9df7cddc.js and injected.js, consisting exclusively of generic fetch and websocket network call detections at lines 215, 218, 226, and 231. These network findings are expected baseline behavior for an extension designed to delete tweets from X/Twitter, which must communicate with the platform's API to perform its stated function.

Critically, the evidence bundle shows zero malware signatures, zero obfuscation findings, zero suspicious IoCs, and zero code-smell findings. The IoC count of 0 is particularly significant—the XIOC extractor would have flagged any suspicious domains if they existed. The developer attribution [email protected] provides identifiable contact information, ruling out the anonymous publisher pattern common in malicious extensions.

The extension's description clearly states its purpose: "Quickly bulk delete tweets and clean up your X profile for better privacy and brand management." This aligns with the observed network activity. A tweet deletion tool legitimately requires network access to Twitter/X APIs, and the content script architecture is standard for browser extensions that interact with web pages.

Strongest counterargument: A skeptic might argue that any extension making network calls could exfiltrate user data to unknown destinations. However, this argument fails because the IoC extractor found zero suspicious domains. If the extension were transmitting data to malicious servers, the network analysis would have extracted those domains as IoC findings. The absence of IoCs combined with zero malware signatures and zero obfuscation strongly indicates legitimate API communication rather than data exfiltration. The medium severity on network findings reflects standard alerting on fetch/websocket calls, not evidence of actual malicious destinations.

The finding volume is appropriately low (6 total) and matches the extension's scope. There are no bundled dependency artifacts creating multiplicative false positives, no minification flagged as obfuscation, and no code-smell rules triggering on basic JavaScript patterns. This represents a legitimate utility extension with expected network behavior.

Key Reasons

• Zero malware signatures detected
• Zero suspicious IoCs extracted from network traffic
• Zero obfuscation findings
• Network activity aligns with stated functionality (tweet deletion requires API access)
• Identifiable developer email provided

False Positive Considerations

• Generic network call detections on fetch/websocket are expected for API-driven extensions
• No specific suspicious domains in IoC findings