LeetTracker

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-05-31. The review verdict is likely false positive with 75% confidence.

Recommended action: suppress false positive. Evidence context: threat category none; evidence quality moderate.

LeetTracker is a Firefox extension designed to display which tech companies ask specific LeetCode problems. The extension's core functionality aligns with its stated purpose: fetching company interview data from a public GitHub repository and displaying it on LeetCode problem pages.

The evidence shows no malware signatures, no obfuscation findings, and no code-smell detections. The 67 IoC findings are dominated by legitimate URLs: leetcode.com/graphql, leetcode.com/problems/*, and api.github.com/repos/PrasanthPradeep/leetcode-companywise-questions/git/trees/main?recursive=1. These URLs directly support the extension's described functionality of fetching company data and displaying it on LeetCode pages.

The network findings in background.js at lines 553, 891, 671, and 978 are generic fetch calls. For an extension that retrieves and displays interview data, fetch operations are expected and necessary. There is no evidence of these calls transmitting user credentials, session tokens, or browsing history to third parties.

Three short domains appear in the IoC findings: t.re, s.nz, and 9.za. These are the most concerning signals. However, they could be false positives from the XIOC extractor parsing URL shorteners or legitimate redirect services. Without malware signatures or obfuscation co-located with these domains, there is insufficient evidence to confirm malicious intent.

The strongest counterargument is the anonymous publisher (developer_name is empty) combined with zero users and suspicious-looking short domains. A skeptic could argue this represents a stealthy data exfiltration tool disguised as a LeetCode helper. However, the extension's network activity is consistent with its stated purpose, and there are no credential access patterns, cookie theft mechanisms, or data exfiltration indicators in the findings. The short domains alone, without corroborating malware signatures or obfuscation, do not justify a malicious verdict.

The developer should add proper attribution to build trust, and the short domains warrant monitoring. Based on the evidence, this extension appears to be a legitimate productivity tool with false-positive IoC findings.

Key Reasons

• No malware signatures or obfuscation findings detected
• Network activity in background.js consistent with stated LeetCode helper functionality
• IoC findings dominated by legitimate leetcode.com and GitHub API URLs
• Anonymous publisher with zero users requires monitoring but not takedown
• Short domains (t.re, s.nz, 9.za) lack corroborating malicious indicators

False Positive Considerations

• XIOC extractor false positives on URL patterns
• Generic fetch calls flagged as network findings
• Short domain parsing artifacts
• GitHub API URLs misidentified as suspicious