Transcript For Youtube Videos
Based on the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 10 months ago
- Version
- v0.0.3
- Artifact
- SHA256 37D…203
- Source
- Findings (non-IoC)
No Findings
All security checks passed
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
No Threats Detected
This extension passed all security checks
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
This YouTube transcript extension shows 331 total findings, but the evidence reveals these are artifacts of automated detection noise rather than actual malicious behavior.
The 297 IoC findings are entirely documentation URLs embedded in bundled libraries. Specific examples include https://html.spec.whatwg.org/multipage/forms.html#category-listed, https://www.w3.org/TR/selectors/#attribute-selectors, and https://github.com/jquery/sizzle/pull/225 extracted from extracted_from_files. These are standard web specification references and jQuery license documentation that the XIOC extractor incorrectly flags as suspicious domains. The presence of https://jquery.org/license confirms these IoCs originate from bundled jQuery code, not malicious network destinations.
The single manifest finding MANIFEST-SENSITIVE-PERM-TABS in manifest.json declares the 'tabs' permission, which is legitimate for a YouTube transcript extension that must access page content to extract video transcripts. This permission aligns with the extension's stated purpose.
The network finding NET-FETCH-contentscript/index.bundle.js:10929 shows a fetch call in a bundled file, consistent with legitimate API requests to fetch YouTube transcript data. No external suspicious domains appear in the network findings.
Critically, the findings summary shows malware-signature: 0 and malware: 0 — there are no actual malware signatures. The 30 code-smell findings are low-severity patterns that fire on standard JavaScript (fetch, crypto, etc.) and are documented as noise in the CVEQ system.
Counterargument: A skeptic might argue the anonymous developer ([email protected]), low version number (0.0.3), and 1000 users warrant concern. However, anonymous email developers are common for utility extensions, and the version number simply indicates early-stage development. The user count is too low to suggest mass compromise, and critically, the actual findings contain no evidence of credential theft, data exfiltration, or suspicious network destinations. The 297 IoCs are all public documentation URLs from web standards, not command-and-control servers or data exfiltration endpoints.
The extension's behavior matches its stated purpose: accessing YouTube pages to extract transcripts. All findings are explainable as bundled library artifacts and standard code patterns.
Key Reasons
- Zero malware signatures detected
- IoC findings are all documentation URLs from bundled jQuery and web standards
- No obfuscation or suspicious domains found
- Tabs permission is legitimate for transcript extraction functionality
- Network findings show only standard fetch calls in bundle files
False Positive Considerations
- IoC extractor flagging documentation URLs as suspicious
- Code-smell rules firing on standard JavaScript patterns
- Bundled library code (jQuery) generating false IoC matches
- Score inflation from finding volume rather than finding nature
Reviewed 2026-04-30; recommended action: suppress false positive; model confidence 85%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
AI Grammar Checker
[email protected]
Detect Font
[email protected]
Dark Mode
[email protected]
种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]