Kindredly - A safer, private web for families
The AI review rates the findings as likely false positive, but the risk score (86/100) still counts them.
Analysis record
- Analysed
- Yesterday
- Version
- v3.1.5.5
- Artifact
- SHA256 D41…BD8
- Source
- Findings (non-IoC)
Is Kindredly - A safer, private web for families safe?
Kindredly is a Firefox add-on from Kindredly.ai aimed at families. It filters what the browser can reach and runs machine learning on your own machine to sort and summarise pages, which is why the package is full of model and library code: js/transformers.webDRb4Ouh4.js, the WebAssembly binaries under modeldata/wasm/, the PDF helpers under pdfjs/wasm/ and a speech build called js/kokoro7QGIOrga.js. The build we scanned lists no browser permission strings at all, so the network traffic it makes comes from ordinary fetch calls inside its own modules.
Two things look alarming at a glance. The endpoint list mixes real destinations such as 1password.com and 2mdn.net with obvious junk such as markdown documentation filenames, and the real ones read like a blocklist a family filter would ship. The single signature hit, YARA--supply_chain_sourcemap_appended_iife in sandbox-nonet.html, flags the shape of bundled JavaScript sitting next to a sourcemap comment, which build tools produce all the time.
What settles it for us: the fetch findings sit in modules named for their purpose (js/appStartRequestCcQV2_Jk.js, js/TextEmbeddingServiceoDz9nN1E.js), the obfuscation hits are Unicode tables in tokenizer code and an icon font in assets/appLifecycle.css, and nothing in the package reads cookies, touches login forms, or talks to a server the developer runs. What we cannot see is real-world vetting, since five users is a very small sample. If a later version changes what that sandbox page does, it deserves a fresh look.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
19 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | supply chain sourcemap appended iife | 1 | sandbox-nonet.html | - |
| LOW | LocalStorageShouldNotBeUsed | 23 | js/appLifecycle.storeOxReVDfu.jsjs/EbookReaderDq4lhT9S.jsjs/mainHomeUSP0OB-A.js +20 more | - |
| LOW | DebuggerStatementsShouldNotBeUsed | 4 | js/compiler-sfc.esm-browserCVZUaTm1.jsmodeldata/static/potion-base-32m/tokenizer.jsonjs/pdf_viewerVXAy2Q8n.js +1 more | - |
| LOW | UsingCommandLineArguments | 3 | js/heic2anyDpG77T-a.jsjs/baseDeYcB21j.jsmodeldata/wasm/ort-wasm-simd-threaded.jsep.mjs | - |
| LOW | credential metamask extension | 2 | js/urlDuplicateMatchingCAw0qzHz.jscontent-script-page-notes.js | - |
| LOW | postinstall persistence mechanism | 53 | js/DiagnosticsReset9jRSNKjj.jspdfjs/standard_fonts/FoxitSymbol.pfbprofile_images/profile-images.json +50 more | - |
| LOW | credential env files | 26 | js/UserLibraryEncryptionDiagnosticsTool.vue_vue_type_script_setup_true_langFH_m6Qzt.jsassets/transformers.web-BiCyDbiP.jsjs/DocumentPipelineTestDBxXXEvT.js +23 more | - |
| LOW | Cerberus | 1 | modeldata/static/potion-base-32m/tokenizer.json | - |
| LOW | credential skype data | 3 | content-script-default-restrictions.jsjs/urlDuplicateMatchingCAw0qzHz.jscontent-script-page-policy.js | - |
| LOW | postinstall file download | 195 | js/SimilarityLabModal.vue_vue_type_script_setup_true_langNR-_ms5w.jsjs/digitalCitizenshipDpPAJ_zD.jsjs/AppEditorHomeHrUTRVR5.js +192 more | - |
| LOW | NoUseEval | 1 | js/vue3-lottie.esD17SrWtj.js | - |
| LOW | NoUseWeakRandom | 67 | js/TextEmbeddingServiceDS8TfltF.jsjs/CommandBarOverlayuvut0wH5.jscontent-script-default-restrictions.js +64 more | - |
| LOW | SQLInjection | 8 | assets/embedding.worker-vO0ASlWU.jsjs/pdfBhK9LaHT.jsjs/indexB3qNFbz_.js +5 more | - |
| LOW | UsingIntrusivePermissionsWithGeolocation | 2 | js/AppIFrameBRY_wb3t.jsjs/ItemBYUm1P1j.js | - |
| LOW | UntrustedContentShouldNotBeIncluded | 1 | js/EbookReaderDq4lhT9S.js | - |
| LOW | postinstall crypto operations | 140 | js/UploadItemImagehBkbMVrG.jsjs/AiAppUploadDMEcTo5N.jscontent-script-search-sidekick.js +137 more | - |
| LOW | postinstall environment access | 223 | js/CreateCollectionDrw7NHm1.jsjs/apiRouter6nvs_RCs.jsjs/useKeptCountsCGQ8a0Ss.js +220 more | - |
| LOW | postinstall file manipulation | 176 | js/SSEServiceB0aKdznM.jscontent-script-search-sidekick.jsjs/LibraryHealthCleanupD-JJLzaE.js +173 more | - |
| LOW | postinstall obfuscation | 2 | js/categoryExplorerSetsCylUBCaq.jsmodeldata/static/potion-base-32m/tokenizer.json | - |
Publisher Evidence
Limited evidenceKindredly.ai
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Firefox does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
19 rules(931 hits)Requested Permissions
12 permissionsAccess and modify data on every website you visit
Exchange messages with programs outside the browser
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
Kindredly 3.1.5, published by Kindredly.ai, describes itself as private, family-friendly browsing with tools to reduce distractions. The package matches that description. It carries a local AI stack: Hugging Face Transformers.js builds in js/transformers.webDRb4Ouh4.js and assets/transformers.web-B5djYHRa.js, ONNX Runtime WebAssembly in modeldata/wasm/ort-wasm-simd-threaded.wasm, PDF.js decoders in pdfjs/wasm/jbig2_nowasm_fallback.js, a Kokoro speech build in js/kokoro7QGIOrga.js, and HEIC conversion in js/heic2anyDpG77T-a.js.
Every obfuscation finding lands inside one of those libraries. OBFUSCATION-UNICODE_HEAVY at js/transformers.webDRb4Ouh4.js:2894 and at assets/transformers.web-B5djYHRa.js:2894 sits in tokenizer code, where large Unicode range tables are the data rather than a disguise. OBFUSCATION-EXCESSIVE_PRIVATE_USE_AREA at assets/appLifecycle.css:0 is a private-use codepoint range in a stylesheet, which is what an icon font looks like. OBFUSCATION-LARGE_BASE64 in pdfjs/wasm/openjpeg_nowasm_fallback.js and jbig2_nowasm_fallback.js is the inline fallback PDF.js ships when WebAssembly is unavailable. OBFUSCATION-LARGE_WASM_FILE on the ort-wasm binaries is the model runtime itself.
The network findings are fetch calls in named application modules: js/appStartRequestCcQV2_Jk.js at lines 1, 69, 99, 1082 and 1278; js/TextEmbeddingServiceoDz9nN1E.js:3; js/esbuildInitC6Le2y3N.js lines 667 and 682; js/baseDeYcB21j.js lines 2495 and 2496. The extracted endpoint list is mostly noise. It holds markdown documentation filenames (21-openwrt-router.md, 26-device-control-plane.md, 08-ai-chat-system.md) and string fragments (1c.za, a-date.now, 1-this.no). The entries that look deliberate read like a content blocklist: 2mdn.net is an ad server, 3blue1brown.com is an educational video channel, 1v1.lol is a browser game, 1password.com is a password manager. A family filter ships exactly that kind of curated list, which explains the 1,946 indicators without implying any of them is contacted.
One finding needs naming. YARA--supply_chain_sourcemap_appended_iife fires at sandbox-nonet.html:177. That rule looks for an immediately-invoked function expression appended after a sourceMappingURL comment, a shape produced by build tooling and also used by attackers grafting code onto a vendored bundle. Here it is the only signature hit, it sits in an HTML sandbox page, and nothing corroborates it: no credential access, no cookie reads, no proxyware, no domain that belongs to a service the developer operates outside the blocklist.
A skeptic would answer that one high-severity supply-chain signature plus fifty fetch sites deserves runtime inspection, and that five users is too small a population to catch a bad release. That is fair as far as it goes. The signature still has no second signal anywhere in the package, and the fetch sites sit in modules named for their job (appStartRequest, TextEmbeddingService). The detail worth carrying forward is the permission surface: the build lists no permissions and no host permissions, and a filtering extension of this kind would normally request content-script access to every site. Re-parsing the manifest with a reader that understands Firefox optional_host_permissions would settle whether that is a parsing gap or a genuinely minimal install.
Key Reasons
- Obfuscation hits map to known library internals: Unicode tables in Transformers.js tokenizer code, an icon font in assets/appLifecycle.css, and inline WebAssembly fallbacks in pdfjs/wasm
- Endpoint list is dominated by extractor noise (markdown filenames, IPv6-ish fragments) plus a content-filter blocklist (2mdn.net, 1v1.lol, 3blue1brown.com, 1password.com), consistent with a family filtering product
- Single malware signature YARA--supply_chain_sourcemap_appended_iife at sandbox-nonet.html:177 has no corroborating credential, cookie, proxyware or C2 evidence
- Fetch findings sit in named application modules (appStartRequestCcQV2_Jk.js, TextEmbeddingServiceoDz9nN1E.js, esbuildInitC6Le2y3N.js) rather than in unexplained payloads
- Named developer (Kindredly.ai) and version 3.1.5 of a product whose stated purpose explains the bundled ML and blocklist data
False Positive Considerations
- Bundled third-party libraries (Transformers.js, ONNX Runtime WASM, PDF.js, Kokoro, heic2any) each triggering their own obfuscation and fetch matches
- Blocklist-driven IoC volume: a family content filter embeds thousands of domains it never contacts
- Unicode tokenizer tables and CSS icon-font private-use codepoints scored as obfuscation
- Extractor garbage such as markdown doc filenames and string fragments parsed as network endpoints
Reviewed 2026-10-30; recommended action: suppress false positive; model confidence 80%.
Firefox version history
Risk trend by version
32 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace