GPT Extension
The AI review rates the findings as likely false positive, but the risk score (50/100) still counts them.
Analysis record
- Analysed
- 8 months ago
- Version
- v1.0
- Artifact
- SHA256 CD2…0F6
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
14 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | AlertStatementsShouldNotBeUsed alert(...) as well as confirm(...) and prompt(...) can be useful for debugging during development, but in production mode this kind of pop-up could expose sensitive information to attackers, and should never be displayed. For more information checkout the CWE-489 (https://cwe.mitre.org/data/definitions/489.html) advisory. | 1 | next-assets/_next/static/chunks/app/newtab/page-69762fa31063f1ed.js | FP 10% |
| HIGH | postinstall crypto operations Cryptographic operations detected | 9 | next-assets/_next/static/chunks/main-92053eafafb1f95c.jsnext-assets/_next/static/chunks/fd9d1056-0615e1e217504726.jsnext-assets/_next/static/chunks/57-550b4a29ff8bb3c1.js +6 more | Risky Plugins Authors FP 30% |
| HIGH | NoUseWeakRandom When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information. As the Math.random() function relies on a weak pseudorandom number generator, this function should not be used for security-critical applications or for protecting sensitive data. In such context, a cryptographically strong pseudorandom number generator (CSPRNG) should be used instead. For more information checkout the CWE-338 (https://cwe.mitre.org/data/definitions/338.html) advisory. | 8 | next-assets/_next/static/chunks/main-92053eafafb1f95c.jsnext-assets/_next/static/chunks/framework-f66176bb897dc684.jsnext-assets/_next/static/chunks/app/newtab/page-69762fa31063f1ed.js +5 more | FP 5% |
| HIGH | postinstall system command System command execution detected | 19 | next-assets/_next/static/chunks/app/newtab/page-69762fa31063f1ed.jsnewtab.txttheme-init.js +16 more | Risky Plugins Authors FP 10% |
| HIGH | postinstall network communication Network communication detected | 12 | next-assets/_next/static/chunks/main-92053eafafb1f95c.jsnext-assets/_next/static/chunks/117-5798dacd4d6076ad.jsnext-assets/_next/static/chunks/polyfills-42372ed130431b0a.js +9 more | Risky Plugins Authors FP 30% |
| HIGH | postinstall file manipulation File system manipulation detected | 12 | next-assets/_next/static/chunks/main-92053eafafb1f95c.jsnext-assets/_next/static/chunks/117-5798dacd4d6076ad.jsnext-assets/_next/static/chunks/webpack-7cbe64ca77549224.js +9 more | Risky Plugins Authors FP 20% |
| HIGH | UsingIntrusivePermissionsWithGeolocation Powerful features are browser features (geolocation, camera, microphone ...) that can be accessed with JavaScript API and may require a permission granted by the user. These features can have a high impact on privacy and user security thus they should only be used if they are really necessary to implement the critical parts of an application.\n\nThis rule highlights intrusive permissions when requested with the future standard (but currently experimental) web browser query API and specific APIs related to the permission. It is highly recommended to customize this rule with the permissions considered as intrusive in the context of the web application. If geolocation is required, always explain to the user why the application needs it and prefer requesting an approximate location when possible. For more information checkout the CWE-250 (https://cwe.mitre.org/data/definitions/250.html) and OWASP A3:2017 (https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html) advisory. | 1 | next-assets/_next/static/chunks/app/newtab/page-69762fa31063f1ed.js | FP 10% |
| HIGH | postinstall persistence mechanism Persistence mechanism detected | 2 | next-assets/_next/static/chunks/344.e8583a7f08098576.jsbackground.js | Risky Plugins Authors FP 20% |
| HIGH | postinstall file download File download activity detected | 12 | 404.htmlnext-assets/_next/static/chunks/117-5798dacd4d6076ad.jsnext-assets/_next/static/chunks/polyfills-42372ed130431b0a.js +9 more | Risky Plugins Authors FP 30% |
| HIGH | postinstall obfuscation Code obfuscation techniques detected | 10 | next-assets/_next/static/css/4246eb7f0cc4ed04.cssnext-assets/_next/static/chunks/117-5798dacd4d6076ad.jsnext-assets/_next/static/chunks/main-92053eafafb1f95c.js +7 more | Risky Plugins Authors FP 20% |
| HIGH | credential env files Environment configuration file path detected | 2 | next-assets/_next/static/chunks/57-550b4a29ff8bb3c1.jsnext-assets/_next/static/chunks/app/newtab/page-69762fa31063f1ed.js | Risky Plugins Authors FP 10% |
| HIGH | LocalStorageShouldNotBeUsed Session storage and local storage are HTML 5 features which allow developers to easily store megabytes of data client-side, as opposed to the 4Kb cookies can accommodate. While useful to speed applications up on the client side, it can be dangerous to store sensitive information this way because the data is not encrypted by default and any script on the page may access it. This rule raises an issue when the localStorage and sessionStorage API's are used. For more information checkout the OWSAP A3:2017 (https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html) advisory. | 1 | next-assets/_next/static/chunks/app/newtab/page-69762fa31063f1ed.js | FP 5% |
| HIGH | postinstall registry modification Windows registry modification detected | 2 | next-assets/_next/static/chunks/57-550b4a29ff8bb3c1.jsnext-assets/_next/static/chunks/polyfills-42372ed130431b0a.js | Risky Plugins Authors FP 30% |
| HIGH | RedirectToUnknownPath Sanitizing untrusted URLs is an important technique for preventing attacks such as request forgeries and malicious redirections. Often, this is done by checking that the host of a URL is in a set of allowed hosts. For more information checkout the CWE-20 (https://cwe.mitre.org/data/definitions/20.html) advisory. | 1 | next-assets/_next/static/chunks/117-5798dacd4d6076ad.js | FP 30% |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
YARA Rules Matched
14 rules(92 hits)Requested Permissions
4 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The GPT Extension, developed by [email protected], is designed to provide AI chat, notes, tasks, and weather information on the new tab. Upon examining the evidence, multiple YARA rule matches were found, including postinstall_file_manipulation, postinstall_obfuscation, postinstall_network_communication, postinstall_crypto_operations, credential_env_files, and postinstall_system_command. These findings, such as the match in /tmp/extract-cd253c91caf61eb8b6e180e4bee47cfc37cc1b1b99c54037c27a7381d77b20f6-3704000274/next-assets/_next/static/chunks/57-550b4a29ff8bb3c1.js, initially suggest potential malicious behavior. However, these YARA rules are known to produce false positives, especially when they match basic Node.js patterns or common JavaScript operations. The network findings, such as NET-FETCH-next-assets/_next/static/chunks/117-5798dacd4d6076ad.js-2835, indicate the extension makes network calls, which is consistent with its described functionality of providing weather and other external information. Notably, there are no specific, suspicious domains or clear indicators of malware signatures beyond the YARA rule matches, which are often associated with legitimate development practices. A strong counterargument to the verdict of likely_false_positive could be that the sheer number of YARA rule matches and network calls indicates a potential for malicious activity. However, considering the nature of these findings and the lack of concrete evidence pointing to malicious intent, such as specific suspicious domains or actual malware signatures, it's reasonable to conclude that these are likely false positives driven by the extension's legitimate functionality and development practices. The developer, [email protected], while not widely recognized, does provide a name, which adds a layer of accountability. Given the analysis, the extension's functionality, and the nature of the findings, the verdict leans towards a false positive, with the understanding that continuous monitoring is always prudent.
Key Reasons
- YARA rule matches on common patterns
- Network calls consistent with described functionality
- Lack of specific, suspicious domains
- No clear malware signatures
False Positive Considerations
- YARA rule matches on common Node.js patterns
- Network calls consistent with extension functionality
Reviewed 2026-05-23; recommended action: monitor; model confidence 70%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace