Is "CallBlitz" on Chrome Web Store Safe to Install?

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-28. The review verdict is likely false positive with 85% confidence.

Recommended action: suppress false positive.
Risk context: MEDIUM risk, score 44/100.
Evidence context: threat category none; evidence quality strong.

CallBlitz Security Analysis

The CallBlitz extension (version 0.1.0.35) presents 13 network-related findings across six JavaScript files, all classified as medium severity with no malware signatures, obfuscation, or suspicious IoC detections. The extension is published by [email protected] with a description stating "Bring your sales floor back," suggesting sales transcription functionality.

All 13 findings are generic network operation detections. The NET-FETCH-js/background/logger.js-112 and NET-FETCH-js/background/logger.js-125 findings identify fetch calls in the background logger script. Similarly, NET-FETCH-js/shared/api.js-4, NET-FETCH-js/shared/api.js-17, NET-FETCH-js/shared/api.js-30, NET-FETCH-js/shared/api.js-43, NET-FETCH-js/shared/api.js-57, and NET-FETCH-js/shared/api.js-81 detect fetch operations in the shared API module. The NET-FETCH-js/shared/logger-client.js-309 finding identifies network calls in the logger client. WebSocket and socket.io connections are detected in NET-WEBSOCKET-js/content-script/transcriber.js-80, NET-SOCKET_IO-js/offscreen/socket-manager.js-89, and NET-SOCKET_IO-js/native-socket.js-14.

These network operations are standard behavior for any extension that communicates with a backend service. The file names themselves—transcriber.js, api.js, logger.js, socket-manager.js—align with legitimate sales transcription functionality rather than malicious activity. There are zero malware signatures, zero obfuscation findings, zero suspicious IoC detections, and zero code-smell findings in the entire evidence bundle.

The strongest counterargument would be that any extension making network calls could exfiltrate data. However, this extension has no obfuscation to hide malicious code, no suspicious domains in the IoC findings (there are zero IoC findings), and no malware signatures. The network calls are in clearly named files (api.js, logger.js, transcriber.js) that suggest legitimate functionality. Without specific evidence of suspicious domains, credential access patterns, or data exfiltration to unknown endpoints, these generic network findings represent normal extension behavior rather than security concerns.

The verdict is likely_false_positive because all findings are benign network operations expected in any extension with backend communication, there is no evidence of malicious intent or behavior, and the file structure and naming conventions align with legitimate sales transcription functionality.

Key Reasons

• All 13 findings are benign network operation detections
• Zero malware signatures, obfuscation, or suspicious IoCs
• File names indicate legitimate transcription functionality
• Developer attribution present ([email protected])
• No evidence of credential theft, hijacking, or exfiltration

False Positive Considerations

• Generic network findings on standard fetch/websocket calls
• Zero malware signatures in evidence bundle
• Zero obfuscation findings
• Zero suspicious IoC detections