Is "Zadein" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-27. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive.
Risk context: MEDIUM risk, score 44/100.
Evidence context: threat category none; evidence quality weak.

This extension shows no evidence of malicious behavior. The findings bundle contains 12 network findings, all of type NET-FETCH, distributed across offscreen.js:12, background.js (lines 155, 366, 572, 595, 626, 663, 687, 710), lib/streaming.js (lines 16, 88), and popup/tool.js:122. These are generic fetch call detections without any associated suspicious domains or URLs.

For an extension described as "AI-powered tools — summarize, rewrite, translate, explain, chat with PDFs & more," fetch calls are required functionality to communicate with AI APIs. The findings summary shows 0 malware-signature findings, 0 malware findings, 0 obfuscation findings, 0 code-smell findings, and 0 IoC findings. This is the expected profile for a legitimate AI utility extension.

The developer email [email protected] is generic rather than a verified publisher identity, and the user count of 3 indicates this is a new or niche extension. However, neither factor constitutes evidence of malicious intent without corroborating technical indicators.

Counterargument: A skeptic might argue that the low user count (3 users) combined with a generic developer email suggests this could be a new malicious extension avoiding scrutiny. However, this reasoning fails because the technical evidence shows zero actual threat indicators. There are no malware signatures, no obfuscation patterns, no suspicious domains in the network findings, and no code-smell detections. The 12 network findings are all the same benign type (fetch calls) that any AI-powered extension requires. Without specific evidence of malicious behavior—such as credential harvesting, browser hijacking, data exfiltration to suspicious domains, or obfuscated payloads—there is no basis to classify this as malicious. The extension's behavior matches its stated purpose, and the findings represent expected functionality rather than security concerns.

Key Reasons

• All 12 findings are generic fetch calls required for AI API communication
• Zero malware signatures or malware findings detected
• Zero obfuscation findings in any file
• Zero code-smell findings indicating suspicious patterns
• Network findings contain no suspicious domains, only fetch detection

False Positive Considerations

• Generic fetch detection flags normal API calls as network findings
• No actual IoC extraction occurred (0 IoC findings)
• AI extension functionality requires network communication