Is "Collaborator Link Assistant" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-27. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive.
Risk context: HIGH risk, score 77/100.
Evidence context: threat category none; evidence quality moderate.

The Collaborator Link Assistant extension demonstrates a clear false-positive pattern across all detection categories. The 55 IoC findings consist entirely of benign artifacts: property access chains misidentified as domains (XIOC-DOMAIN-msg.id, XIOC-DOMAIN-chrome.runtime.id, XIOC-DOMAIN-tab.id, XIOC-DOMAIN-json.map), IPv6 fragment garbage (XIOC-IP-e::), and legitimate infrastructure domains (https://google.com/*, https://script.google.com/macros/s/). The single extension-owned domain (https://collaborator.pro/ua/api/public/racoon/lookup) aligns with the developer email [email protected] and the stated functionality as a link tracker and marketplace checker.

Network findings in background.js:194 and content.js:346 show standard fetch() calls, which is expected behavior for an extension that tracks links and checks marketplaces. No credential access, no browser hijacking indicators, and no data exfiltration patterns appear in the evidence.

The 45 code-smell findings are classified as low severity and match known false-positive patterns including postinstall rules and credential reference patterns that fire on basic JavaScript. Zero malware signatures and zero obfuscation findings eliminate the possibility of malicious payloads.

Counterargument: A skeptic might cite the 108 total findings and 55 IoCs as evidence of suspicious behavior. However, CVEQ's IoC extractor is documented to produce massive false-positive volumes from property access chains and minified code. The finding COUNT is meaningless; the NATURE of these findings reveals no malicious intent. Every IoC is either a Chrome API property (tab.id, chrome.runtime.id), source map reference (json.map), IPv6 hex fragment (e::), Google infrastructure, or the extension's own service domain. No suspicious third-party domains appear in the evidence. The extension's description matches its actual behavior, the developer email matches the service domain, and the absence of malware signatures or obfuscation confirms this is benign functionality flagged by noisy automated detection.

The recommended action is to suppress these false positives. The extension serves a legitimate purpose with no evidence of malicious behavior.

Key Reasons

• Zero malware signatures detected
• All IoCs are property chains or legitimate domains
• No obfuscation findings
• Developer email matches service domain
• Network calls align with stated functionality

False Positive Considerations

• IoC property access chains (msg.id, tab.id, chrome.runtime.id)
• IPv6 fragment garbage (e::)
• Code-smell findings on basic JavaScript patterns
• Google infrastructure domains (script.google.com, google.com)