Smart Video Controls
The AI review rates the findings as likely false positive, but the risk score (85/100) still counts them.
Analysis record
- Analysed
- Yesterday
- Version
- v3.6.8
- Artifact
- SHA256 705…AD5
- Source
- Findings (non-IoC)
Is Smart Video Controls safe?
Smart Video Controls is a Firefox extension that promises auto-resume and keyboard shortcuts for embedded video players. The manifest declares no permissions, but the scanner observed background.js and lib/supabase-client.js making fetch requests to a long list of advertising domains including doubleclick.net, googleadservices.com, and criteo.net, plus social domains like facebook.com and instagram.com. The 51 IoC findings and 33 code-smell findings are known scanner noise: the IoC extractor mistakes minified code for IP addresses and flags common CDN hosts, while the code-smell rules trigger on standard JavaScript patterns. No malware signatures, obfuscation, or credential-theft indicators appeared. The developer publishes under the domain divyamrastogi.dev and the extension uses Supabase, a legitimate backend service. With only one recorded user, this looks like a new or test release that may be loading third-party video players which bring their own tracking networks. The findings do not show malicious code, but the undeclared network activity means the extension can contact advertising networks without user consent.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
9 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 2 | background.jscontent.js | - |
| LOW | postinstall file download | 5 | lib/supabase-client.jscleanup.jsbackground.js +2 more | - |
| LOW | HavingAPermissiveCrossOriginResourceSharingPolicy | 1 | content.js | - |
| LOW | NoUseWeakRandom | 1 | popup.js | - |
| LOW | postinstall network communication | 6 | popup.jspositions.jsbackground.js +3 more | - |
| LOW | postinstall crypto operations | 2 | popup.jsbackground.js | - |
| LOW | postinstall file manipulation | 7 | background.jscontent.jscleanup-main.js +4 more | - |
| LOW | postinstall system command | 8 | cleanup-main.jspopup.jsbackground.js +5 more | - |
| LOW | postinstall obfuscation | 4 | background.jscontent.jslib/supabase-client.js +1 more | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidenceDivyam Rastogi
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Firefox does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
YARA Rules Matched
9 rules(36 hits)Requested Permissions
4 permissionsAccess and modify data on every website you visit
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
Smart Video Controls declares no permissions in its manifest yet the scanner recorded five NET-FETCH findings in background.js:490 and lib/supabase-client.js at lines 15, 33, 43, and 62. The network_endpoints list shows the extension contacting a long roster of advertising and tracking domains including adform.net, adnxs.com, adsrvr.org, amazon-adsystem.com, casalemedia.com, criteo.com, criteo.net, doubleclick.net, googleadservices.com, googlesyndication.com, and openx.net. It also reaches facebook.com, instagram.com, dailymotion.com, music.youtube.com, and the developer's own domain divyamrastogi.dev. The 51 IoC findings and 33 code-smell findings are consistent with known false-positive patterns: the IoC extractor flags CDN domains, property-access chains, and IPv6 fragments, while the YARA code-smell rules fire on ordinary JavaScript constructs. No malware signatures, obfuscation, or tool-poisoning findings appear. The extension has only one recorded user and version 3.6.4, suggesting a new or test release. The strongest counterargument is that the advertising domains could indicate undeclared tracking or monetization behavior. However, the complete absence of declared permissions, the presence of a legitimate developer domain, and the Supabase client library (a common backend-as-a-service) point to a benign video-control tool that may be loading third-party players or analytics without proper manifest entries. The findings are best explained by scanner noise and incomplete manifest analysis rather than malicious intent.
Key Reasons
- No permissions declared but network findings show fetches to advertising domains
- 51 IoC findings match known extractor false-positive patterns
- 33 code-smell findings are low-severity YARA noise
- Zero malware signatures or obfuscation findings
- Developer domain present; single-user count suggests new/test release
False Positive Considerations
- IoC extractor garbage (CDN domains, property-access chains)
- YARA code-smell rules firing on ordinary JavaScript
- Bundled library code (supabase-client.js) generating network findings
Reviewed 2026-09-30; recommended action: monitor; model confidence 78%.
Firefox version history
Risk trend by version
3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace