StayFree - Web Analytics & Time Tracker

AI Security Review

Evidence context: threat category none; evidence quality moderate.

StayFree is a published Firefox add-on from ST Pulse with a straightforward pitch: it measures time spent per site and blocks the ones you choose. The scan is thin in the places that usually matter. Zero IoC hits, zero malware signatures, zero code-smell rules and zero dependency findings across seventeen items. The manifest contributed one finding, and the bundle records no host permissions and no network endpoints, so the network picture has to come from the script-level findings themselves.

Those eight network findings are all fetch or socket.io detections in files whose names describe the product: background.js:15, chunks/DashboardPomodoroSettings-y4vkjdVT.js:1, chunks/defineAppConfig-Bcu4ejQa.js:1, content-scripts/usage-monitoring.js:15, content-scripts/gen-ai-collector.js:15, and content-scripts/in-app-blocking.js:1. Reporting per-site minutes, syncing a dashboard and fetching block lists all require outbound calls. None of the eight points at a named endpoint, and the bundle lists no domains at all, suspicious or otherwise. That removes the usual hijack and exfiltration evidence: no query.* search template, no new tab override, no credential or cookie collector aimed at login domains.

The eight high-severity items are the entire reason this extension landed in a review queue. Every one is OBFUSCATION-UNICODE_HEAVY, sitting on files such as chunks/DashboardSettings-wmN2dHlv.js:1, content-scripts/block-website.js:1 and content-scripts/keyword-blocking.js:102. That rule counts the share of non-ASCII characters in a file. A settings dashboard is exactly where currency symbols, translated labels, smart quotes and date formats pile up. The finding title names the mechanism, unicode density, and says nothing about hidden instructions. Minified bundle output in chunks/ has the same effect, since a single-line file concentrates every string in the product into one place.

A skeptic would point out that eight unicode findings plus eight network findings is a lot of yellow on a small extension, and that a time tracker with no declared host permissions does not square with content scripts reading page data. That mismatch is worth flagging and it is why confidence here sits below a slam dunk. It also reflects a gap in the extraction: the extension has to declare matches somewhere to inject usage-monitoring.js, and the scan did not surface them. If a real concern exists in this build, it is where the fetched telemetry goes, and version 2.10.9 gives no endpoint to check.

For the verdict to flip, the code would need a named destination that is not the vendor's own service, or a signature matching actual malware. Neither is present. What is present is a unicode-density heuristic with a benign explanation in every file it flagged, alongside fetch calls that match the stated function of the product.

Key Reasons

• Zero malware signatures, zero IoC hits and zero code-smell findings across all 17 items
• All 8 network findings are fetch/socket.io detections in feature-named scripts (usage-monitoring.js, in-app-blocking.js, gen-ai-collector.js) with no named suspicious endpoint
• All 8 high-severity items are OBFUSCATION-UNICODE_HEAVY, a density heuristic that fires on translated dashboard strings and minified chunks
• No browser-hijack artifacts: no search template, no new tab override, no credential or cookie collector
• Extension is attributed to a publisher (ST Pulse) with a description that matches observed behavior

False Positive Considerations

• OBFUSCATION-UNICODE_HEAVY firing on non-ASCII dashboard strings, currency symbols and i18n labels in chunks/
• Minified single-line bundle files in chunks/ concentrating all product strings into one file
• NET-FETCH and NET-SOCKET_IO detections from ordinary telemetry and config loading rather than a suspicious destination
• No endpoint or domain data captured alongside the network findings, leaving the calls unattributed

Reviewed 2026-10-15; recommended action: suppress false positive; model confidence 80%.