ModHeader
The AI review rates the findings as likely false positive, but the risk score (59/100) still counts them.
Analysis record
- Analysed
- 5 days ago
- Version
- v1.2.0
- Artifact
- SHA256 B81…D44
- Source
- Findings (non-IoC)
Is ModHeader safe?
ModHeader bills itself as a header editor for testing API requests and debugging sites in Chrome. The manifest declares no permissions and no host permissions, so this build cannot read tabs, reach cookies or rewrite headers on any site. Among the network strings, forms.gle and reactjs.org point at a Google Forms link and the React documentation site, the kind of URLs that show up in help pages.
The scanner matched a socket.io pattern in assets/Toggle-BBImUuk3.js and fetch calls in seventeen locale chunks such as assets/de-BRvqa2C6.js and assets/ja-BzgTgIVR.js. Those files carry translation strings for German, Japanese and the other shipped languages. A bundled app loads each one separately, which produces a fetch call in every chunk. Nothing in those files contacts an outside server with user data.
Zero malware signatures turned up. The 156 code-smell hits sit in minified bundle output, where ordinary patterns like fetch, crypto calls and environment lookups trip broad rules. The one high-severity flag, OBFUSCATION-INVISIBLE_ZERO_WIDTH in _locales/fa/messages.json, comes from the Farsi translation file, where zero-width joiners are required to render Persian text correctly. Obfuscation detection that trips on a Persian language file has found the writing system.
One detail deserves attention. The publisher email on the listing, [email protected], has no connection to the ModHeader name, and that mismatch would matter if this build could do anything with the data it saw. An empty permission list means it cannot. What would change our read: a future version that requests host permissions or declares a background service worker.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
11 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 2 | service-worker.jsassets/it-DAjjs1_v.js | - |
| LOW | postinstall file download | 23 | assets/cs-qSA9ItI3.jsassets/it-DAjjs1_v.jsassets/id-DlNva6Qu.js +20 more | - |
| LOW | NoUseWeakRandom | 2 | assets/Toggle-BBImUuk3.jsassets/origin-builder-NHt3vRFY.js | - |
| LOW | LocalStorageShouldNotBeUsed | 1 | assets/popup-B0BdfAiq.js | - |
| LOW | postinstall crypto operations | 5 | assets/origin-builder-NHt3vRFY.jsassets/options-5RPA30vi.js_metadata/verified_contents.json +2 more | - |
| LOW | postinstall obfuscation | 28 | _locales/af/messages.json_locales/sl/messages.jsonassets/es-C-QWIKrA.js +25 more | - |
| LOW | postinstall file manipulation | 30 | assets/pt-BR-Cw3BHLiD.jsassets/it-DAjjs1_v.jsassets/es-C-QWIKrA.js +27 more | - |
| LOW | postinstall environment access | 3 | assets/popup-B0BdfAiq.jsassets/options-5RPA30vi.jsassets/matcher-DaAiO47J.js | - |
| LOW | postinstall system command | 50 | service-worker.jsassets/origin-builder-NHt3vRFY.jsassets/Toggle-BBImUuk3.js +47 more | - |
| LOW | postinstall registry modification | 3 | assets/origin-builder-NHt3vRFY.jsservice-worker.jsassets/matcher-DaAiO47J.js | - |
| LOW | postinstall network communication | 9 | assets/origin-builder-NHt3vRFY.js_locales/eu/messages.json_locales/no/messages.json +6 more | - |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
11 rules(156 hits)Requested Permissions
3 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
What this build can do
ModHeader describes itself as a header editor for testing API requests and debugging websites in Chrome. In this build the manifest declares no permissions and no host permissions, so it carries none of the access a working header editor needs, such as webRequest, cookies, tabs or storage. Of the strings listed as network endpoints, banner.info, io.download, popup.domains and popup.scope.site look like property chains pulled out of minified code, while forms.gle and reactjs.org point at a Google Forms page and the React documentation site, the sort of links that live in a help page.
What the network findings show
The network hits split into two groups. assets/Toggle-BBImUuk3.js:37 trips the socket.io rule, and seventeen locale chunks (assets/de-BRvqa2C6.js, assets/ja-BzgTgIVR.js, assets/ru-qcDYrE7b.js and the rest) each trip a fetch rule. Those filenames follow the language-code pattern a bundler produces when it splits translations into separate files, and one fetch per file matches how a bundled app pulls the strings for the language it needs. Nothing in the finding set pairs either group with a transfer of user content, and the manifest holds no host permissions that would let this build send anything anywhere.
Why the volume looks worse than the code
Zero malware signatures matched, along with zero tool-poisoning, dependency and secret findings. The remaining volume comes from 156 code-smell hits and 15 IoC entries, both of which fire on minified bundle output. Ordinary patterns such as fetch calls, crypto imports and environment lookups trip broad rules written for Node.js and generic JavaScript. The one high-severity item, OBFUSCATION-INVISIBLE_ZERO_WIDTH in _locales/fa/messages.json, sits in the Farsi translation file. Zero-width joiners belong to Persian text rendering, and a Persian locale file without them would render incorrectly. That finding measures the writing system, not an encoded payload.
The case against this read
A skeptic would point at the publisher. The listing credits [email protected], an address with no connection to the ModHeader name, and carries version 1.2.0 with 3000 users. Copying a popular extension's name and description happens often, and clones sometimes request more access in a later release. That concern attaches to the listing rather than to the code in front of us. With an empty permission set and no host permissions, this version cannot read tabs, touch cookies or rewrite a header, so the mismatch has no mechanism to cause harm here. A future update that asks for webRequest or host access would change the picture and justify a fresh examination.
Key Reasons
- No malware signatures, and the 156 code-smell hits plus 15 IoCs all sit in minified bundle output typical of any bundled JavaScript app
- Every network finding resolves to i18n behaviour: one fetch per locale chunk (assets/de-BRvqa2C6.js, assets/ja-BzgTgIVR.js) plus a socket.io pattern in assets/Toggle-BBImUuk3.js
- The only high-severity finding, OBFUSCATION-INVISIBLE_ZERO_WIDTH in _locales/fa/messages.json, is a Farsi locale file where zero-width joiners are legitimate characters
- Manifest declares no permissions and no host permissions, so this build has no mechanism to exfiltrate data, read cookies or modify headers
- Publisher address [email protected] does not match the ModHeader brand, which is a listing-level concern worth monitoring but not evidence of harmful code
False Positive Considerations
- Code-smell rules firing on minified bundle output (fetch, crypto, environment lookups)
- IoC extractor reading property chains such as banner.info, io.download and popup.scope.site as domains
- Per-locale fetch calls generated by bundler i18n chunk splitting
- Zero-width joiners in _locales/fa/messages.json, required for Persian text rendering
Reviewed 2026-10-14; recommended action: monitor; model confidence 70%.
Chrome version history
Risk trend by version
2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace