Is "Sponsy" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-28. The review verdict is likely false positive with 75% confidence.

Recommended action: no action.
Risk context: MEDIUM risk, score 53/100.
Evidence context: threat category none; evidence quality weak.

The Sponsy Chrome extension (version 1.2.7) presents minimal security concerns based on the available evidence. The extension has 6 users and is published under the email address [email protected]. The CVEQ analysis identified only 3 medium-severity findings across two categories: manifest analysis and network activity.

The manifest analysis finding (MANIFEST-SENSITIVE-PERM-TABS in manifest.json) indicates the extension requests the 'tabs' permission. This permission allows the extension to access tab information and is commonly used by legitimate extensions for functionality like tab management, content injection, or page interaction. While sensitive, this permission alone does not indicate malicious intent and is standard for many benign extensions.

The two network findings (NET-FETCH-assets/sidepanel.html-B7s-c_q0.js-1 and NET-FETCH-assets/content-script.ts-Bq4ZSEA-.js-1) detect fetch calls in the extension's JavaScript files. These are generic network activity detections that do not reveal specific destination domains or suspicious endpoints. Without domain-level IoC data showing connections to malicious or tracking servers, these network calls represent normal extension behavior for communicating with backend services.

Critically, the evidence bundle contains zero malware signatures, zero obfuscation findings, zero code-smell detections, and zero suspicious IoCs. The absence of these high-confidence threat indicators is significant. Extensions exhibiting malicious behavior typically trigger malware signatures, obfuscation patterns, or suspicious domain connections in their network traffic.

The strongest counterargument to this verdict would be the combination of a generic developer email ([email protected]) and extremely low user count (6 users). This could suggest a throwaway extension created for testing or potentially malicious purposes. However, the actual code analysis shows no evidence of malicious behavior - no credential theft patterns, no browser hijacking indicators, no data exfiltration mechanisms, and no obfuscated payloads. The extension's behavior as detected by the static analysis is consistent with normal, legitimate extension functionality.

Given the minimal finding count, absence of high-confidence threat indicators, and normal code behavior, this extension is classified as likely_false_positive. The findings are driven by standard extension permissions and network activity rather than malicious indicators.

Key Reasons

• Zero malware signatures detected
• Zero obfuscation or code-smell findings
• Zero suspicious IoCs or malicious domains
• Network findings are generic fetch calls without suspicious destinations
• Tabs permission is standard for legitimate extensions

False Positive Considerations

• Generic network fetch calls flagged as findings
• Sensitive permissions (tabs) flagged but common in legitimate extensions
• Low finding count driven by manifest and basic network activity