Sticky Notes

AI Security Review

Evidence context: threat category none; evidence quality moderate.

What the extension does

Sticky Notes writes a note onto a page and keeps it there for later. The code matches that description. content-scripts/content.js runs on pages and issues a fetch, chunks/popup-B-ui4NFJ.js issues two more from the popup, and background.js holds a WebSocket alongside a fetch. The hosts those calls reach are sticky.peerpulse.dev and peerpulse.dev, a Google sign-in client (501317350230-2t25j93e3d4aej8pb9e14bk9fcfik5l9.apps.googleusercontent.com), and four ordinary destinations: mozilla.com, youtu.be, youtube.com, news.ycombinator.com. A notes tool that follows you between tabs needs a server and a way to identify the person using it. Google for sign-in and a WebSocket to the notes service for live updates is exactly that shape.

What the scanner found

The scan returned 88 findings: 62 code-smell, 21 IoC, 5 network, and nothing at all in the malware, malware-signature, obfuscation, secret, dependency, tool-poisoning or manifest-analysis buckets. Nothing is rated critical or high. The five network records are NET-WEBSOCKET-background.js-1, NET-FETCH-background.js-1, NET-FETCH-chunks/popup-B-ui4NFJ.js-1, NET-FETCH-chunks/popup-B-ui4NFJ.js-3 and NET-FETCH-content-scripts/content.js-3. Each one states that a call exists at that file and line. None of them reaches a destination that is out of place for a notes app.

Most of the count is noise. The IoC list contains globalthis.chrome and head.center, which are property access chains inside minified JavaScript that were read as domain names, and mozilla.com, youtu.be, youtube.com and news.ycombinator.com, which are the kind of hosts that show up in bundled library code and sample data. The 62 code-smell hits are the class that fires on any non-trivial bundle, covering postinstall patterns, credential keyword rules and code-quality checks. chunks/popup-B-ui4NFJ.js is a bundled chunk, so every module inside it contributes its own matches. background.js is the extension's service worker and does the syncing, which is why it holds the WebSocket and one fetch.

Why not something worse

Nothing in this bundle reads cookies or credentials, replaces a search engine, touches history, or carries an encrypted payload. There is no malware signature and no obfuscation. The manifest the scanner read declares no API permissions and no host permissions, which closes off cookies, downloads, webRequest and tabs access. What a hidden channel could carry away from a permissions list that empty is close to nothing.

The strongest counterargument

A WebSocket in background.js is a channel that stays open, and peerpulse.dev is not a host we can tie to the publisher from this evidence alone. Combine that with one recorded user and no recognizable publisher name, and the profile reads like a small extension holding a private line. That reads past the details. The subdomain is sticky.peerpulse.dev, which carries the extension's own name, the same codebase holds a Google OAuth client, and a note-sync feature cannot work without a backend to sync to. Two things would settle it: a live capture confirming which payloads travel over NET-WEBSOCKET-background.js-1, and confirmation that peerpulse.dev belongs to publisher prtngn. Until then the evidence points at a notes app talking to its own server.

Key Reasons

• Zero malware signatures, zero obfuscation, zero secrets and zero tool-poisoning findings across the whole scan
• All five network records (NET-WEBSOCKET-background.js-1, NET-FETCH-background.js-1, NET-FETCH-chunks/popup-B-ui4NFJ.js-1 and -3, NET-FETCH-content-scripts/content.js-3) point at the extension's own notes backend sticky.peerpulse.dev or a Google sign-in client
• 83 of 88 findings are the known noise classes: 62 low-severity code-smell matches and 21 IoCs that include property chains like globalthis.chrome and head.center
• Manifest declares no API permissions and no host permissions, leaving no route to cookies, downloads, webRequest or tabs

False Positive Considerations

• 62 low-severity code-smell rules firing on bundled JavaScript in background.js and chunks/popup-B-ui4NFJ.js
• IoC extractor reading property access chains (globalthis.chrome, head.center) as domain names
• Benign or bundled hosts (mozilla.com, youtu.be, youtube.com, news.ycombinator.com) counted as suspicious endpoints
• Multiple fetch matches inside one bundled chunk counted as separate network findings

Reviewed 2026-10-16; recommended action: no action; model confidence 75%.