Better Peakbagger
The AI review rates the findings as likely false positive, but the risk score (85/100) still counts them.
Analysis record
- Analysed
- 6 days ago
- Version
- v4.0.2
- Artifact
- SHA256 713…A82
- Source
- Findings (non-IoC)
Is Better Peakbagger safe?
Better Peakbagger adds a set of tools to Peakbagger.com: it captures an activity as a draft, reads GPX tracks, filters ascents and applies a dark theme. The manifest data in this scan lists no host permissions, so nothing here points at broad access across every site you visit.
Three network calls turn up in the source. content/ascent-filter.js opens a socket.io connection, content/big-map.js makes a fetch call and provider-page.js makes another. Each one lines up with a feature the extension advertises, since a live map and a provider lookup both need to pull data from somewhere. The long domain list holds mostly junk. Strings like center.lat, camera.transform.center.lat and cm-editor.cm are JavaScript property chains that the extractor read as hostnames.
Two obfuscation findings point at content/ascent-editor.js. Line 145 carries a heavy load of Unicode characters and line 183 holds a large base64 blob. An editor handling place names with accents, degree and elevation symbols and encoded track data will trip both checks without hiding anything.
Nothing in the package matched a malware signature, and that absence tells you more than the finding count does. What the scanner reacted to were minified property names and character data inside an editor file, not code reaching out to a stranger's server.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
14 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 3 | PRIVACY.mdbackground.jscontent/ascent-editor.js | - |
| LOW | NoUseEval | 1 | vendor/maplibre-gl-worker.mjs | - |
| LOW | NoUseWeakRandom | 3 | content/ascent-editor.jsbackground.jsvendor/maplibre-gl-shared.mjs | - |
| LOW | postinstall file download | 33 | popup/popup.jsREADME.mdoptions/favorites-page.js +30 more | - |
| LOW | UsingIntrusivePermissionsWithGeolocation | 1 | vendor/maplibre-gl.mjs | - |
| LOW | SQLInjection | 1 | background.js | - |
| LOW | postinstall file manipulation | 57 | content/terrain-map.jsoptions/drafts-page.jsvendor/maplibre-gl.mjs +54 more | - |
| LOW | postinstall network communication | 62 | terrain/terrain-frame.jsoptions/drafts-page.jsREADME.md +59 more | - |
| LOW | postinstall crypto operations | 21 | vendor/maplibre-gl.mjsREADME.mdphotos/photos.html +18 more | - |
| LOW | postinstall system command | 63 | photos/photos-head.jsoptions/drafts-page.jsREADME.md +60 more | - |
| LOW | postinstall registry modification | 3 | vendor/maplibre-gl-shared.mjsPRIVACY.mdvendor/chart.umd.min.js | - |
| LOW | postinstall obfuscation | 29 | options/drafts-page.jscontent/peak-weather.jsvendor/marked.umd.js +26 more | - |
| LOW | OriginsNotVerified | 1 | content/gpx-analyzer.js | - |
| LOW | LocalStorageShouldNotBeUsed | 12 | content/theme.jscaltopo/access-head.jsgaia/access-head.js +9 more | - |
Publisher Evidence
Limited evidencewilmtang
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Firefox does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
YARA Rules Matched
14 rules(290 hits)Requested Permissions
45 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
Better Peakbagger is a Firefox add-on from developer wilmtang, version 4.0.2, with one listed user. Its description covers four jobs on Peakbagger.com: capturing an activity into a draft, reading GPX files, filtering ascents and applying a dark theme. Nothing in the scanned package matched a malware signature or a malware rule. The total of 731 findings splits into 436 indicator strings, 290 code-smell hits, three network findings and two obfuscation findings, and that mix describes scanner noise on a small content-script codebase.
The indicator list shows the problem plainly. Entries such as center.lat, camera.transform.center.lat, at.actions.photo, coords.zw, bottom.zw and cm-editor.cm are dot-separated property chains and two-letter string fragments that the extractor read as hostnames. 2-e.top and bt.no share that texture. dailymotion.com is the only recognizable site in the list, and no companion finding shows code building a request to it. Treating these as risky endpoints inflates the picture without describing anything the extension does.
The three network findings line up with stated features. NET-SOCKET_IO-content/ascent-filter.js-2 covers a socket.io reference inside the ascent filter. NET-FETCH-content/big-map.js-1 and NET-FETCH-provider-page.js-1 cover fetch calls in the map view and the provider page. A live map and a provider lookup both need to pull data from somewhere, so these calls fit the product as described.
The two obfuscation findings sit in a single file. OBFUSCATION-UNICODE_HEAVY-content/ascent-editor.js-145 flags a dense run of Unicode characters at line 145, and OBFUSCATION-LARGE_BASE64-content/ascent-editor.js-183 flags a base64 blob at line 183. An editor panel that handles place names with accents, degree and elevation symbols, and encoded track data produces both patterns on its own. What matters is that no malware signature sits beside either one in content/ascent-editor.js, which is the combination that would signal a hidden payload.
A skeptic would push back on exactly that point: a high-severity obfuscation finding plus a base64 blob in an extension almost nobody has installed looks like a payload nobody would catch. That reading requires a second signal that never arrives. There is no malware match in the file, no malware match anywhere in the package, and no network finding tied to content/ascent-editor.js. The empty manifest fields in this scan, both permissions and host_permissions, keep this short of a clean bill of health, since we cannot confirm what the extension requests at install time. Reading lines 145 and 183 of content/ascent-editor.js and capturing where the socket.io connection in content/ascent-filter.js points would settle both questions.
Key Reasons
- Zero malware signatures across the entire package despite 731 total findings
- Indicator list is dominated by property-chain fragments such as camera.transform.center.lat and cm-editor.cm misread as hostnames
- All three network findings (NET-SOCKET_IO-content/ascent-filter.js-2, NET-FETCH-content/big-map.js-1, NET-FETCH-provider-page.js-1) match the advertised GPX and map features
- Obfuscation findings in content/ascent-editor.js are an editor-local Unicode block and base64 blob with no malware signature beside them
- 290 code-smell hits carry no behavioral weight
False Positive Considerations
- XIOC extractor reading JavaScript property chains and two-letter fragments as domains
- Generic YARA code-smell rules firing on ordinary content-script JavaScript
- Unicode-heavy and base64 detection on an editor file that renders place names and track data
- Finding-count inflation from a minified content-script codebase
Reviewed 2026-10-18; recommended action: monitor; model confidence 74%.
Firefox version history
Risk trend by version
16 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Chrome Tab Search
wilmtang
LeetCode VS Code Auth Sync
wilmtang
Open Tab on the Right
wilmtang
vscode-leetcode-auth-sync
wilmtang
LeetCode with Auth Sync
wilmtang
Falcon Secure Access Extension - Connect
Seraphic Algorithms