SelectorsHub

AI Security Review

Evidence context: threat category none; evidence quality moderate.

SelectorsHub 5.8.5 produces 30 findings in this scan. Twenty-nine of them sit in the network bucket, all at medium severity. No malware signature matched. No obfuscation marker, no IoC, no dependency alert, no leaked secret. The manifest declares no host permissions and no API permissions, which leaves the extension unable to read or modify the pages a user visits. For a tool that inspects selectors inside a DevTools panel, that permission profile matches the description on the tin.

The network findings cluster in three files: devtools-panel/devtools-script.js at lines 29, 445 and 458, extension/background.js at lines 8 and 28, and devtools-panel/login.js at lines 2, 4, 18, 19, 25, 27, 29, 32, 37 and 38. Titles like NET-FETCH-extension/background.js-28 and NET-JQUERY_AJAX-devtools-panel/login.js-18 name the mechanism rather than the destination. They record a fetch call and a jQuery ajax call. The scan captured no endpoint string at all.

A file named login.js inside an extension that runs an account and licensing flow is the one place worth a second look. Somebody typing a password into that panel hands the extension a credential, and a credential is what a thief wants. That concern only bites if the data leaves for an unexplained host. The scan lists no external endpoint, no host permission that would allow a third-party transmission, and no obfuscation concealing one.

One manifest-analysis finding appears in the total, with no detail attached. Manifest checks of this type flag permission declarations, and this manifest declares nothing out of the ordinary.

A skeptic would point at 29 network findings and call that a lot. The number reflects the detector, not the code. Network detection fires on the API pattern, so every fetch and every jquery ajax call site generates its own finding. The count scales with the size of the login and panel source, which is exactly what you expect from a mature developer tool. Compare the shape of a real threat: a malware signature sharing a file with obfuscation, a custom search domain, a proxyware relay. None of those appear anywhere in this package.

Publisher identity reinforces the read. SelectorsHub has shipped to 400,000 Chrome users under [email protected], and the files the scanner opened correspond to the advertised job of generating and verifying locators.

The gap that remains: without endpoint strings we cannot name the login server. A future build that adds host permissions or third-party domains would change this picture and warrant a fresh look.

Key Reasons

• All 29 network findings record fetch and jQuery Ajax call sites in devtools-panel/devtools-script.js, extension/background.js and devtools-panel/login.js rather than any destination domain
• The manifest declares no host permissions, no API permissions, and the scan lists no external endpoints
• Zero malware-signature, obfuscation, IoC, secret or dependency findings
• Files examined match the advertised job of generating and verifying Playwright, XPath and CSS locators for a listing with 400,000 Chrome users

False Positive Considerations

• Network detection fires on the fetch/ajax API pattern, so each call site in bundled login and panel code becomes its own finding
• No host permissions and no endpoint strings mean there is no transmission path to flag
• No malware signature, obfuscation or IoC findings alongside the network events

Reviewed 2026-10-03; recommended action: suppress false positive; model confidence 82%.