Find The Font
Score-based assessment (medium risk, 49/100). No analyst review available.
Analysis record
- Analysed
- 8 months ago
- Version
- v1.1.8
- Artifact
- SHA256 5B5…449
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
7 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | postinstall crypto operations Cryptographic operations detected | 1 | _metadata/verified_contents.json | Risky Plugins Authors FP 30% |
| HIGH | postinstall file download File download activity detected | 4 | _locales/da/messages.json_locales/fil/messages.json_locales/nl/messages.json +1 more | Risky Plugins Authors FP 30% |
| HIGH | postinstall obfuscation Code obfuscation techniques detected | 2 | _locales/lt/messages.json_locales/et/messages.json | Risky Plugins Authors FP 20% |
| HIGH | postinstall network communication Network communication detected | 3 | _locales/de/messages.jsonbackground.jscontentScript.js | Risky Plugins Authors FP 30% |
| HIGH | postinstall file manipulation File system manipulation detected | 1 | contentScript.js | Risky Plugins Authors FP 20% |
| HIGH | postinstall environment access Environment variable access detected | 1 | background.js | Risky Plugins Authors FP 40% |
| HIGH | postinstall system command System command execution detected | 1 | background.js | Risky Plugins Authors FP 10% |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
7 rules(13 hits)Requested Permissions
4 permissionsAccess and modify data on every website you visit
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The 'Find The Font' extension (version 1.1.8) shows no malicious findings across all categories. The developer is listed as an email address ([email protected]), which is a minor red flag for anonymity, but no code-smell, IoC, or malware signatures were detected. The extension's described functionality (font identification) aligns with its purpose, and there are no suspicious domains, obfuscation, or credential-access patterns in the evidence. The absence of findings in findings_by_category indicates no detected threats. A skeptic might argue that the anonymous developer increases risk, but without corroborating evidence of malicious behavior, this alone does not justify a higher threat classification. The extension's low user count (498) and lack of verified publisher status warrant cautious monitoring, but current data supports a benign classification.
Key Reasons
- No malicious findings detected in any category
- Anonymous developer (email address) without verified publisher status
- Extension functionality aligns with described purpose
- No suspicious domains or obfuscation in evidence
Reviewed 2026-04-25; recommended action: no action; model confidence 70%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Image Converter
[email protected]
Spell Check
[email protected]
YouTube Transcript Generator
[email protected]
PDF Sign
[email protected]
种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]