Sticky Notes
The AI review rates the findings as likely false positive, but the risk score (85/100) still counts them.
Analysis record
- Analysed
- 2 weeks ago
- Version
- v1.15.4
- Artifact
- SHA256 ADF…CE7
- Source
- Findings (non-IoC)
Is Sticky Notes safe?
Sticky Notes leaves a note on a page so it is still there when you open that tab again. The manifest we read declares no API permissions and no host permissions, so it cannot reach your cookies, downloads, browsing history, or sites other than the pages where its content script runs. The code makes network calls from background.js and content-scripts/content.js to sticky.peerpulse.dev, and it uses a Google sign-in client, 501317350230-2t25j93e3d4aej8pb9e14bk9fcfik5l9.apps.googleusercontent.com. A notes service that follows you between tabs needs both of those things, somewhere to keep the notes and a way to know who you are.
That is also what the scanner flagged. A record like NET-FETCH-content-scripts/content.js-3 means a fetch call exists inside the content script. If it pointed somewhere unrelated, that could mean page text leaving your browser. The addresses this extension reaches are its own notes backend at sticky.peerpulse.dev, Google for sign-in, and a handful of ordinary sites: mozilla.com, youtu.be, youtube.com and news.ycombinator.com. A WebSocket in background.js keeps a live channel to the same notes backend, which is how a sync feature stays current instead of polling.
The bulk of the count is scanner noise. Sixty-two of the findings are code-smell matches, a class that fires on ordinary JavaScript and carries no weight by itself. Entries such as globalthis.chrome and head.center are property accesses in bundled code that were read as domain names. Nothing here matched a malware signature, nothing was obfuscated, and no code touches credentials or cookies.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
8 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 5 | background.js_locales/pt_BR/messages.jsoncontent-scripts/content.js +2 more | - |
| LOW | postinstall file download | 3 | background.jschunks/popup-B-ui4NFJ.jscontent-scripts/content.js | - |
| LOW | NoUseWeakRandom | 1 | content-scripts/content.js | - |
| LOW | postinstall crypto operations | 3 | chunks/popup-B-ui4NFJ.jscontent-scripts/content.jsbackground.js | - |
| LOW | postinstall system command | 21 | _locales/pl/messages.json_locales/pt_BR/messages.json_locales/tr/messages.json +18 more | - |
| LOW | postinstall file manipulation | 21 | _locales/tr/messages.jsoncontent-scripts/content.jsassets/popup-D6yIkLST.css +18 more | - |
| LOW | postinstall obfuscation | 1 | background.js | - |
| LOW | postinstall network communication | 7 | chunks/popup-B-ui4NFJ.js_locales/de/messages.json_locales/fr/messages.json +4 more | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidenceprtngn
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Firefox does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
10 evidence rows available.
Finding Categories
YARA Rules Matched
8 rules(62 hits)Requested Permissions
9 permissionsAccess and modify data on every website you visit
Access your identity and sign-in tokens
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
What the extension does
Sticky Notes writes a note onto a page and keeps it there for later. The code matches that description. content-scripts/content.js runs on pages and issues a fetch, chunks/popup-B-ui4NFJ.js issues two more from the popup, and background.js holds a WebSocket alongside a fetch. The hosts those calls reach are sticky.peerpulse.dev and peerpulse.dev, a Google sign-in client (501317350230-2t25j93e3d4aej8pb9e14bk9fcfik5l9.apps.googleusercontent.com), and four ordinary destinations: mozilla.com, youtu.be, youtube.com, news.ycombinator.com. A notes tool that follows you between tabs needs a server and a way to identify the person using it. Google for sign-in and a WebSocket to the notes service for live updates is exactly that shape.
What the scanner found
The scan returned 88 findings: 62 code-smell, 21 IoC, 5 network, and nothing at all in the malware, malware-signature, obfuscation, secret, dependency, tool-poisoning or manifest-analysis buckets. Nothing is rated critical or high. The five network records are NET-WEBSOCKET-background.js-1, NET-FETCH-background.js-1, NET-FETCH-chunks/popup-B-ui4NFJ.js-1, NET-FETCH-chunks/popup-B-ui4NFJ.js-3 and NET-FETCH-content-scripts/content.js-3. Each one states that a call exists at that file and line. None of them reaches a destination that is out of place for a notes app.
Most of the count is noise. The IoC list contains globalthis.chrome and head.center, which are property access chains inside minified JavaScript that were read as domain names, and mozilla.com, youtu.be, youtube.com and news.ycombinator.com, which are the kind of hosts that show up in bundled library code and sample data. The 62 code-smell hits are the class that fires on any non-trivial bundle, covering postinstall patterns, credential keyword rules and code-quality checks. chunks/popup-B-ui4NFJ.js is a bundled chunk, so every module inside it contributes its own matches. background.js is the extension's service worker and does the syncing, which is why it holds the WebSocket and one fetch.
Why not something worse
Nothing in this bundle reads cookies or credentials, replaces a search engine, touches history, or carries an encrypted payload. There is no malware signature and no obfuscation. The manifest the scanner read declares no API permissions and no host permissions, which closes off cookies, downloads, webRequest and tabs access. What a hidden channel could carry away from a permissions list that empty is close to nothing.
The strongest counterargument
A WebSocket in background.js is a channel that stays open, and peerpulse.dev is not a host we can tie to the publisher from this evidence alone. Combine that with one recorded user and no recognizable publisher name, and the profile reads like a small extension holding a private line. That reads past the details. The subdomain is sticky.peerpulse.dev, which carries the extension's own name, the same codebase holds a Google OAuth client, and a note-sync feature cannot work without a backend to sync to. Two things would settle it: a live capture confirming which payloads travel over NET-WEBSOCKET-background.js-1, and confirmation that peerpulse.dev belongs to publisher prtngn. Until then the evidence points at a notes app talking to its own server.
Key Reasons
- Zero malware signatures, zero obfuscation, zero secrets and zero tool-poisoning findings across the whole scan
- All five network records (NET-WEBSOCKET-background.js-1, NET-FETCH-background.js-1, NET-FETCH-chunks/popup-B-ui4NFJ.js-1 and -3, NET-FETCH-content-scripts/content.js-3) point at the extension's own notes backend sticky.peerpulse.dev or a Google sign-in client
- 83 of 88 findings are the known noise classes: 62 low-severity code-smell matches and 21 IoCs that include property chains like globalthis.chrome and head.center
- Manifest declares no API permissions and no host permissions, leaving no route to cookies, downloads, webRequest or tabs
False Positive Considerations
- 62 low-severity code-smell rules firing on bundled JavaScript in background.js and chunks/popup-B-ui4NFJ.js
- IoC extractor reading property access chains (globalthis.chrome, head.center) as domain names
- Benign or bundled hosts (mozilla.com, youtu.be, youtube.com, news.ycombinator.com) counted as suspicious endpoints
- Multiple fetch matches inside one bundled chunk counted as separate network findings
Reviewed 2026-10-16; recommended action: no action; model confidence 75%.
Firefox version history
Risk trend by version
2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.