Chrome Web Store

ModHeader

by [email protected] · 3.0K users · 3.0 rating
899d807a-df42-537f-ac2c-ed394f516277 | v1.2.0
59/ 100
MEDIUM risk
+22 since v0.1.0
Analyst verdict
Review before use

The AI review rates the findings as likely false positive, but the risk score (59/100) still counts them.

Analysis record

Analysed
5 days ago
Version
v1.2.0
Artifact
SHA256 B81…D44
Source
Findings (non-IoC)

Is ModHeader safe?

ModHeader bills itself as a header editor for testing API requests and debugging sites in Chrome. The manifest declares no permissions and no host permissions, so this build cannot read tabs, reach cookies or rewrite headers on any site. Among the network strings, forms.gle and reactjs.org point at a Google Forms link and the React documentation site, the kind of URLs that show up in help pages.

The scanner matched a socket.io pattern in assets/Toggle-BBImUuk3.js and fetch calls in seventeen locale chunks such as assets/de-BRvqa2C6.js and assets/ja-BzgTgIVR.js. Those files carry translation strings for German, Japanese and the other shipped languages. A bundled app loads each one separately, which produces a fetch call in every chunk. Nothing in those files contacts an outside server with user data.

Zero malware signatures turned up. The 156 code-smell hits sit in minified bundle output, where ordinary patterns like fetch, crypto calls and environment lookups trip broad rules. The one high-severity flag, OBFUSCATION-INVISIBLE_ZERO_WIDTH in _locales/fa/messages.json, comes from the Farsi translation file, where zero-width joiners are required to render Persian text correctly. Obfuscation detection that trips on a Persian language file has found the writing system.

One detail deserves attention. The publisher email on the listing, [email protected], has no connection to the ModHeader name, and that mismatch would matter if this build could do anything with the data it saw. An empty permission list means it cannot. What would change our read: a future version that requests host permissions or declares a background service worker.

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

178 detail rows

YARA Rule Matches

11 rules
SeverityRuleHitsFilesMetadata
LOWpostinstall persistence mechanism 2
service-worker.jsassets/it-DAjjs1_v.js
-
LOWpostinstall file download 23
assets/ru-qcDYrE7b.jsassets/it-DAjjs1_v.jsassets/id-DlNva6Qu.js +20 more
-
LOWNoUseWeakRandom 2
assets/Toggle-BBImUuk3.jsassets/origin-builder-NHt3vRFY.js
-
LOWLocalStorageShouldNotBeUsed 1
assets/popup-B0BdfAiq.js
-
LOWpostinstall crypto operations 5
assets/Toggle-BBImUuk3.js_locales/zu/messages.jsonassets/options-5RPA30vi.js +2 more
-
LOWpostinstall obfuscation 28
assets/hi-CxGgizJP.jsservice-worker.jsassets/pt-PT-CbF6-VQF.js +25 more
-
LOWpostinstall file manipulation 30
assets/origin-builder-NHt3vRFY.js_locales/en/messages.jsonassets/pt-PT-CbF6-VQF.js +27 more
-
LOWpostinstall environment access 3
assets/matcher-DaAiO47J.jsassets/popup-B0BdfAiq.jsassets/options-5RPA30vi.js
-
LOWpostinstall system command 50
_locales/nl/messages.json_locales/rw/messages.json_locales/hi/messages.json +47 more
-
LOWpostinstall registry modification 3
service-worker.jsassets/matcher-DaAiO47J.jsassets/origin-builder-NHt3vRFY.js
-
LOWpostinstall network communication 9
assets/de-BRvqa2C6.js_locales/zu/messages.jsonassets/Toggle-BBImUuk3.js +6 more
-

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

43
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
11
Portfolio

11 evidence rows available.

Finding Categories

1
Obfuscation
21
Network
15
IoC Indicators

YARA Rules Matched

11 rules(156 hits)
postinstall persistence mechanism postinstall file download NoUseWeakRandom LocalStorageShouldNotBeUsed postinstall crypto operations postinstall obfuscation postinstall file manipulation postinstall environment access postinstall system command postinstall registry modification postinstall network communication

Requested Permissions

3 permissions
activeTab
Medium
storage
Low
declarativeNetRequestWithHostAccess
Low

AI Security Report

AI Security Review

Evidence context: threat category none; evidence quality moderate.

What this build can do

ModHeader describes itself as a header editor for testing API requests and debugging websites in Chrome. In this build the manifest declares no permissions and no host permissions, so it carries none of the access a working header editor needs, such as webRequest, cookies, tabs or storage. Of the strings listed as network endpoints, banner.info, io.download, popup.domains and popup.scope.site look like property chains pulled out of minified code, while forms.gle and reactjs.org point at a Google Forms page and the React documentation site, the sort of links that live in a help page.

What the network findings show

The network hits split into two groups. assets/Toggle-BBImUuk3.js:37 trips the socket.io rule, and seventeen locale chunks (assets/de-BRvqa2C6.js, assets/ja-BzgTgIVR.js, assets/ru-qcDYrE7b.js and the rest) each trip a fetch rule. Those filenames follow the language-code pattern a bundler produces when it splits translations into separate files, and one fetch per file matches how a bundled app pulls the strings for the language it needs. Nothing in the finding set pairs either group with a transfer of user content, and the manifest holds no host permissions that would let this build send anything anywhere.

Why the volume looks worse than the code

Zero malware signatures matched, along with zero tool-poisoning, dependency and secret findings. The remaining volume comes from 156 code-smell hits and 15 IoC entries, both of which fire on minified bundle output. Ordinary patterns such as fetch calls, crypto imports and environment lookups trip broad rules written for Node.js and generic JavaScript. The one high-severity item, OBFUSCATION-INVISIBLE_ZERO_WIDTH in _locales/fa/messages.json, sits in the Farsi translation file. Zero-width joiners belong to Persian text rendering, and a Persian locale file without them would render incorrectly. That finding measures the writing system, not an encoded payload.

The case against this read

A skeptic would point at the publisher. The listing credits [email protected], an address with no connection to the ModHeader name, and carries version 1.2.0 with 3000 users. Copying a popular extension's name and description happens often, and clones sometimes request more access in a later release. That concern attaches to the listing rather than to the code in front of us. With an empty permission set and no host permissions, this version cannot read tabs, touch cookies or rewrite a header, so the mismatch has no mechanism to cause harm here. A future update that asks for webRequest or host access would change the picture and justify a fresh examination.

Key Reasons

  • No malware signatures, and the 156 code-smell hits plus 15 IoCs all sit in minified bundle output typical of any bundled JavaScript app
  • Every network finding resolves to i18n behaviour: one fetch per locale chunk (assets/de-BRvqa2C6.js, assets/ja-BzgTgIVR.js) plus a socket.io pattern in assets/Toggle-BBImUuk3.js
  • The only high-severity finding, OBFUSCATION-INVISIBLE_ZERO_WIDTH in _locales/fa/messages.json, is a Farsi locale file where zero-width joiners are legitimate characters
  • Manifest declares no permissions and no host permissions, so this build has no mechanism to exfiltrate data, read cookies or modify headers
  • Publisher address [email protected] does not match the ModHeader brand, which is a listing-level concern worth monitoring but not evidence of harmful code

False Positive Considerations

  • Code-smell rules firing on minified bundle output (fetch, crypto, environment lookups)
  • IoC extractor reading property chains such as banner.info, io.download and popup.scope.site as domains
  • Per-locale fetch calls generated by bundler i18n chunk splitting
  • Zero-width joiners in _locales/fa/messages.json, required for Persian text rendering

Reviewed 2026-10-14; recommended action: monitor; model confidence 70%.

Chrome version history

Risk trend by version

2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.

Selected
59
Change since first
+22
Change from previous
+22
Versions:
First analyzed version
0.1.0
Jul 22, 2026
Risk range
37 to 59
Across analyzed versions
Latest analyzed version
1.2.0
Oct 11, 2026
Selected version
medium
Version
v1.2.0
5 days ago
Risk score
59
Findings
193
Change vs previous
+22

Pick any point on the chart to explore that version's code below.

About This Extension

Open Source. The source code can be found here: https://github.com/Ahorm/open-modheader Use ModHeader to turn Chrome into a focused workspace for editing HTTP request and response fields during real work. It helps an API tester check behavior fast, without opening a heavy desktop stack. When testing API flows, you can change one value, reload the page, and see a clearer result for a login, route, or feature state. 🧩 Quick Header Checks ⚡ Run a quick HTTP header test before you blame code, cache, login state, or network noise. ⚡ Keep the ModHeader Chrome extension ready for release reviews, partner demos, support cases, and internal audits. ⚡ Use test API checks in the same browser where the product already lives, so the result feels tied to real product use. 💪 Why Teams Choose ModHeader ✓ ModHeader is made for teams that want control without clutter. ✓ The ModHeader extension gives you a simple place to prepare values, compare outcomes, and document what changed. ✓ It supports API testing with a clean rhythm that fits daily work. ✓ Small checks stay simple, so they do not become long investigations. 🛠️ How It Works 1. Open the page or service path you want to inspect. 2. Add a rule with the header editor, then keep the scope narrow and easy to review. 3. Confirm the result with an HTTP header tester before sharing notes. 4. Save a useful setup, so the next review starts faster and begins from proven steps. A busy team does not need more mystery. It needs a visible path from change to outcome. A REST API client may show the call, while a REST client application helps organize deeper checks across projects, teams, and release cycles. 📋 Practical Workflow Benefits ✅ Cut repeated setup during staging, support, and launch review. ✅ Keep each rule tied to a clear task, so normal browsing stays clean. ✅ Switch between roles, regions, and partner states with less manual typing. ✅ Capture evidence that engineers, QA, and support can understand at once. ✅ Remove temporary work after the session, so the next check starts fresh and does not rely on memory. Some defects hide in small details. A missing value can break access, change content, or send a user down the wrong path. This is where careful browser work and a REST client together can make the cause easier to see before the issue spreads. 🔍 Common Use Cases ▸ Reproduce customer reports without rebuilding every account from scratch. ▸ Review a feature flag before wider rollout, then note the exact result. ▸ Check region logic during localization work, pricing review, or partner QA. ▸ Compare staging and production behavior with fewer moving parts. ▸ Support demos where one controlled change proves the workflow. ▸ Teach newer teammates how request changes affect visible pages, so learning feels concrete. 🚦 Strong Release Support ⚡ The Mod Header Chrome extension is useful when release pressure is high and clarity matters. ⚡ Pair it with REST API testing tools for deeper service review. ⚡ Return to the browser to confirm the user-facing effect. ⚡ Keep discussion practical, with evidence close to the screen people already trust. 🌠 Built for Daily Development ✦ Use ModHeader Chrome for fast browser-side checks during active development. ✦ Bring a REST tool into the process when a service needs a direct call. ✦ Keep profiles for common projects, environments, or review patterns. ✦ Share short steps instead of long threads with unclear screenshots. ✦ Protect work habits by keeping changes focused, limited, and easy to remove. ✦ Help support teams speak from proof, not memory or guesswork. ✦ Give product reviewers a calmer way to verify launch details before meetings and share clear notes. 🛡️ Clear Context and Sensible Control ◆ ModHeader fits well beside API testing tools when a team needs both speed and context. ◆ It gives each user a clearer browser view while other utilities handle deeper checks. ◆ Security and privacy stay practical through focused habits. ◆ Keep changes limited, remove them after review, and avoid sharing more context than the task needs. You do not need a complex setup to start. Add ModHeader, create a small rule, refresh, and compare the page against the expected state. When the pattern is useful, keep it for later; when it is done, remove it, so personal sessions stay separate from work sessions. 🚀 Get Started with ModHeader * Use ModHeader when you want cleaner checks, sharper notes, and less friction between discovery and fix. * Add the ModHeader extension to your Chrome workflow for releases, demos, support reviews, and daily investigation. * Keep each check focused, so routine work does not become a long project. * Use it for fast triage and careful verification. * Help teams speak from the same facts.

Frequently Asked Questions