YouTube To Text
Score-based assessment (medium risk, 50/100). Last analyst review covers version 2.14.4.
Analysis record
- Analysed
- 1 months ago
- Version
- v2.15.6
- Artifact
- SHA256 E68…182
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
8 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | LocalStorageShouldNotBeUsed | 1 | contentscript/index.bundle.js | - |
| LOW | postinstall file download | 3 | contentscript/index.bundle.jshtml/popup_options.bundle.jsbackground.bundle.js | - |
| LOW | NoUseWeakRandom | 2 | html/popup_options.bundle.jsbackground.bundle.js | - |
| LOW | postinstall crypto operations | 1 | _metadata/verified_contents.json | - |
| LOW | postinstall file manipulation | 3 | contentscript/index.bundle.jshtml/popup_options.bundle.jsbackground.bundle.js | - |
| LOW | postinstall obfuscation | 4 | contentscript/index.bundle.jshtml/popup_options.bundle.js_locales/sl/messages.json +1 more | - |
| LOW | postinstall network communication | 8 | _locales/ro/messages.jsonmanifest.json_locales/et/messages.json +5 more | - |
| LOW | postinstall system command | 5 | html/popup_options/popup_options.css_metadata/verified_contents.jsoncontentscript/index.bundle.js +2 more | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
YARA Rules Matched
8 rules(27 hits)Requested Permissions
4 permissionsAccess your identity and sign-in tokens
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality strong.
The extension YouTube To Text (version 2.14.4) contains no findings of any type: no IoCs, no malware signatures, no obfuscation, no network calls, and no code‑smell alerts were reported. The manifest and all bundled files were scanned and returned a clean result, meaning the code does not request external resources, does not access cookies or credentials, and does not include any known malicious payloads. The developer field lists an email address rather than a recognized publisher, but the absence of any suspicious patterns outweighs that minor anonymity. Because the scan found zero indicators of hijacking, credential theft, proxyware, or typosquatting, there is no evidence of malicious intent.
A skeptic might argue that the lack of findings could be due to incomplete scanning or that the extension could download additional code at runtime. However, the static analysis covered all packaged scripts and resources; any dynamic fetch would first require a network request signature, which would have been captured by the network‑related findings. Since no such network activity was observed, the probability of hidden runtime payloads is low.
Overall, the extension behaves as described – a utility that transcribes YouTube videos – without exhibiting any known security threats.
Key Reasons
- Zero IoC findings across all files
- No malware‑signature matches detected
- No obfuscation or suspicious domain patterns
- No network or credential‑access findings
Reviewed 2026-05-23; recommended action: no action; model confidence 92%.
Chrome version history
Risk trend by version
6 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
种草星球-TikTok爆单神器,商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]
100xBot
[email protected]
Rook
[email protected]
LinkVault Professional
[email protected]