Chrome Web Store Verified

LinkVault Professional

9307977f-3198-5d91-ac96-e04dd86f0cf7 | v1.7.636
86/ 100
CRITICAL risk
Risk verdict
Do not install

Score-based assessment (critical risk, 86/100). No analyst review available.

Analysis record

Analysed
1 weeks ago
Version
v1.7.636
Artifact
SHA256 65E…B86
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

277 detail rows
Showing 25 of 53 · highest severity first

YARA Rule Matches

15 rules
SeverityRuleHitsFilesMetadata
HIGHsupply chain sourcemap appended iife 1
flutter_bootstrap.js
-
LOWLocalStorageShouldNotBeUsed 2
js/main.jsmain.dart.js
-
LOWcredential env files 2
background.jsmain.dart.js
-
LOWpostinstall persistence mechanism 22
canvaskit/chromium/canvaskit.jsbackground.jsi18n/strings.json +19 more
-
LOWpostinstall file download 34
privacy.htmlcanvaskit/chromium/canvaskit.js.symbolscanvaskit/skwasm.wasm +31 more
-
LOWSQLInjection 1
main.dart.js
-
LOWNoUseEval 7
canvaskit/chromium/canvaskit.wasmcanvaskit/skwasm.wasmcanvaskit/canvaskit.wasm +4 more
-
LOWNoUseWeakRandom 7
background.jsmain.dart.jscanvaskit/chromium/canvaskit.wasm +4 more
-
LOWpostinstall crypto operations 18
canvaskit/webparagraph/canvaskit.wasmcanvaskit/chromium/canvaskit.wasmbackground.js +15 more
-
LOWpostinstall obfuscation 28
canvaskit/skwasm_heavy.js.symbolsflutter.jscontext_menus.js +25 more
-
LOWpostinstall file manipulation 31
flutter.jscanvaskit/chromium/canvaskit.js.symbolscanvaskit/skwasm.wasm +28 more
-
LOWpostinstall network communication 27
canvaskit/wimp.wasmcanvaskit/chromium/canvaskit.jsassets/NOTICES +24 more
-
LOWpostinstall environment access 1
assets/NOTICES
-
LOWpostinstall registry modification 15
canvaskit/chromium/canvaskit.jscanvaskit/skwasm_heavy.js.symbolscanvaskit/webparagraph/canvaskit.js.symbols +12 more
-
LOWpostinstall system command 28
canvaskit/chromium/canvaskit.jscontext_menus.jscanvaskit/canvaskit.js.symbols +25 more
-

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

28
Noisy-finding weight
x1.00
Publisher domain
pve.ch
Observed
Store verification signal
Limited signal
Limited
Extension portfolio
1
Portfolio

13 evidence rows available.

Finding Categories

1
Malware Signatures
9
Obfuscation
43
Network
3,680
IoC Indicators

YARA Rules Matched

15 rules(224 hits)
supply chain sourcemap appended iife LocalStorageShouldNotBeUsed credential env files postinstall persistence mechanism postinstall file download SQLInjection NoUseEval NoUseWeakRandom postinstall crypto operations postinstall obfuscation postinstall file manipulation postinstall network communication postinstall environment access postinstall registry modification postinstall system command

Requested Permissions

14 permissions
https://*/*
Dangerous
http://*/*
Dangerous
identity

Access your identity and sign-in tokens

High
tabs
Medium
activeTab
Medium
bookmarks
Medium
storage
Low
scripting
Low
sidePanel
Low
alarms
Low
contextMenus
Low
https://linkvault-api.pve.ch/*
Low
https://linkvault-api-int.pve.ch/*
Low
https://*.a.run.app/*
Low

Security Analysis Summary

Security Analysis Overview

LinkVault Professional is a Chrome Web Store extension published by [email protected]. Version 1.7.636 has been analyzed by the Risky Plugins security platform, receiving a risk score of 85.54/100 (CRITICAL risk) based on 3957 security findings.

Risk Assessment

This extension presents critical security risk. Severe issues were detected, potentially including malware indicators, exposed secrets, or dangerous behaviors. Installation is strongly discouraged until these issues are addressed.

Findings Breakdown

  • High: 3 finding(s)
  • Medium: 3731 finding(s)
  • Low: 223 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

  • Malware Detection: YARA rule matching against 2,400+ malware signatures
  • Secret Detection: Scanning for exposed API keys, tokens, and credentials
  • Static Analysis: Code-level security analysis for common vulnerability patterns
  • Network Analysis: Detection of suspicious network communications and endpoints
  • Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

LinkVault Professional is published by [email protected] on the Chrome Web Store marketplace.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

About This Extension

Found something worth keeping? Share it — and find it again later. A bookmark manager and read-later library: save links from any app, keep them offline, and put a photo or PDF next to the link. ONE LIBRARY An article on the train, a video at night, a poster at the bus stop. Tap Share, pick LinkVault, and it lands in your library on the device. The title comes with the page. If you allow AI processing, you get a summary, a category and tags. Sync across your devices when you want the same library everywhere. Later, one word in the search is enough. SHARE FROM ANY APP Every app has a Share button. An article, a YouTube video, a screenshot, a PDF, a photo: tap Share, pick LinkVault. No copy-paste marathon. LINKS AND FILES • Web links and articles • Screenshots and photos • PDF documents and text files • Videos and images • Text from any app OPTIONAL AI — ONLY IF YOU ASK AI is off until you tap Accept. The first time a non-private item would be processed, a dialog names what is sent and to whom. If you accept, LinkVault sends that item to OpenRouter, which routes it to OpenAI (text), Google Gemini (images), or Mistral (documents) for a summary, tags, and a category. The page title does not need AI. Private items are never sent. Don't allow keeps everything on the device. Turn AI off anytime in Settings → AI processing. We do not keep that content on our servers after processing. FIND IT LATER • Categories and tags • Full-text search • Filter by category, type, tags, or favourites • Sort by date, title, or last updated TEAM WORKSPACES (OPTIONAL) • A shared library for a crew • Invite by link or email • Owner and member roles • Switch between your private library and a team • The same team library on every client Your private library stays private. NATIVE ON EVERY PLATFORM iPhone, iPad, Android, Mac, and Windows are native apps. Chrome and Edge are extensions. On Linux and other systems without a native app, the progressive web app has the same feature set. The library stays on the device. An account is for sync and for a shared team library. ON THE DEVICE • The library lives on the device. Sync only if you sign in. • No account needed to save and search • No tracking, no ads • Works offline • You can turn AI off in Settings BROWSER (CHROME & EDGE) The extension drops the current page into the same library when you turn on sync. Search for LinkVault in the Chrome Web Store or Microsoft Edge Add-ons. LinkVault Professional is free to download. Capture and search offline. Optional sync and AI run on our servers and have a monthly allowance. No purchases in the app, no tracking, no ads.

Frequently Asked Questions