Is Speech Recognition Polyfill (STT) safe to use?

Speech Recognition Polyfill (STT) has a security risk score of 100/100 (CRITICAL risk). Our security analysis detected 171 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of Speech Recognition Polyfill (STT)?

Based on our automated security analysis, Speech Recognition Polyfill (STT) presents critical risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

Is "Speech Recognition Polyfill (STT)" on Firefox Add-ons Safe to Install?

Name: Speech Recognition Polyfill (STT)
Availability: InStock
Rating: 5 (1 reviews)
Author: apersongithub

apersongithub · firefox · v1.5.6

Test the extension by using speech color changer and don't forget to leave a review! The extension's code is open source and viewable on GitHub . ⭐ Key Features: Works out of the box if your first language is English, one option away for other languages. Extension uses WASM, no external client or app needed. Privacy first, vosk (local) is the default model. Decent Web Speech API Support through Polyfill (obviously) Customizable Keybind for Speech to Text anywhere, alongside the polyfill Many Local Models to choose from (Vosk/Whisper) Realtime Streaming/Word-to-Word Continuous Speech like Chrome (Vosk/AssemblyAI) Local & Offline Transcription Support (Vosk/Whisper..see info part) Cloud/Server Transcription Support Extensive Per-Site and Default Customization Options Icon Status and Notification toasts to guide you. Toasts arent enabled by default Exporting and Importing Settings Auto Language Detection through the based on site request and some speech models Many languages to choose from when using their respected country code (support depends on the engine used). 📝 Info: On first install this extension will open the options page, the default model language is English but this is easily changeable. This extension allows per-site customization and a multitude of different models to decipher language. It also has a key-bind for Speech to Text (default: Alt + A). Keep in mind that this is not a complete solution and the API doesn't have full support but it's pretty close. Speech Detection is nearly as instantaneous (depending on the model), but not as accurate as Google Chrome's Cloud API. The extension icon color/indicator changes depending on the process so pin it to your menu to verify the extension is working as intended. A red mic/error icon does not necessarily mean your mic isn't working but rather the speech may have been cancelled by user input, missing cloud API key, or that it is unintelligible (usually its the latter). Make sure you are using the correct mic and speak loud, slow, and clear otherwise your voice may not be detected or unintelligible. Change the default model to the cloud or slightly larger or different local ones if you experience problems with voice recognition (this may impair performance). You can also try enabling "boost microphone gain" if you are a soft speaker. If you are constantly processing audio over 1-2 mins, disable the ultimatum processing timeout feature in the settings. If you're using Duolingo or similar and are trying to do the speaking practice of the language that you are learning, it is recommended to set the language in the extension to the one you are learning (navigate to the site -> click extension icon -> set language then click "save for site"). This isn't required but it will significantly improve the accuracy of your speech since the model now knows the exact language you are trying to speak. (This isn't exactly necessary for every site, one example is google translate which tells us the exact language that is being used through the input box's data so auto-detect works fine). Look at the images for more help. You can also use my Speech Recognition Polyfill Userscript as an alternative for simplicity/accuracy, or cross-browser compatibility purposes, but the extension is overall better and isn't that complicated to use anyways. This userscript provides one-to-one equivalent speech recognition results when compared to Google Chrome's backend implementation when using the "v1" provider (I think chrome uses this exact endpoint that I reverse engineered lol) in the userscript config. The "v2" provider is more accurate and supports grammar, thought its only SLIGHTLY slower due to technical limitations. Language support with this userscript is not fully known but likely wide-ranging. ❗ Caveats: 8GB of RAM is a minimum requirement since it could easily take up to a decent chuck when utilizing larger models. A modern CPU/GPU is recommended. An internet connection is required overall, but especially before using offline mode since the model needs to cache itself first. Not being illiterate and reading the FAQ before making a review. Understanding that implementing the Web Speech API perfectly isn't feasible and that this extension has more support than anything else available. Even though the model runs locally, the extension re-downloads it either when idle or after closing the tab/opening a new one that utilizes the extension (for memory preservation purposes). This is ultimately better than packaging the large models within the extension for the time being and for most models, the download speed will be near instant for the general population. We also have an option in settings to keep the default model cached without re-downloading every time. Its basically locally offline as long as you use the caching option and don't close the browser or switch models. Apart from locally you can use the cloud based model which is less hardware intensive. The extension will take ~1GB of ram on normal/cloud models and up to ~7GB if you use the biggest model (you don't need to use the biggest model lol). I've implemented decent memory management to compensate.

Risk Assessment

Analyzed

100

out of 100

CRITICAL

171 security findings detected across all analyzers

Firefox extension requesting 3 permissions

Severity Breakdown

Critical

High

117

Medium

Low

Info

Finding Categories

Malware Signatures

Network

104

IoC Indicators

YARA Rules Matched

10 rules(54 hits)

postinstall persistence mechanism NoUseWeakRandom postinstall system command postinstall obfuscation postinstall network communication postinstall file manipulation AlertStatementsShouldNotBeUsed postinstall file download postinstall crypto operations OriginsNotVerified

Requested Permissions

3 permissions

<all_urls>

Access and modify data on every website you visit

Dangerous

tabs

Medium

storage

Low

About This Extension

Test the extension by using <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/2ef5ad64782c1ec4dabf218201aab07c0c9b0555a2d5d86b8ea4188281ecd19b/https%3A//mdn.github.io/dom-examples/web-speech-api/speech-color-changer/" rel="nofollow">speech color changer</a> and don't forget to leave a review! The extension's code is open source and viewable on <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/bb523c4da843de43e008ba10f5a0e8727a8631cbae1a0a3c97f9bdda2a16fc37/https%3A//github.com/apersongithub/Speech-Recognition-Polyfill" rel="nofollow">GitHub</a>. <code>⭐ Key Features:</code> <ul><li>Works out of the box if your first language is English, one option away for other languages.</li><li>Extension uses WASM, no external client or app needed.</li><li>Privacy first, vosk (local) is the default model.</li><li>Decent Web Speech API Support through Polyfill (obviously)</li><li>Customizable Keybind for Speech to Text anywhere, alongside the polyfill</li><li>Many Local Models to choose from (Vosk/Whisper)</li><li>Realtime Streaming/Word-to-Word Continuous Speech like Chrome (Vosk/AssemblyAI)</li><li>Local & Offline Transcription Support (Vosk/Whisper..see info part)</li><li>Cloud/Server Transcription Support</li><li>Extensive Per-Site and Default Customization Options</li><li>Icon Status and Notification toasts to guide you. Toasts arent enabled by default</li><li>Exporting and Importing Settings</li><li>Auto Language Detection through the based on site request and some speech models</li><li>Many languages to choose from when using their respected country code (support depends on the engine used).</li></ul> <code>📝 Info:</code> <ul><li>On first install this extension will open the options page, the default model language is English but this is easily changeable. This extension allows per-site customization and a multitude of different models to decipher language. It also has a key-bind for Speech to Text (default: Alt + A). Keep in mind that this is not a complete solution and the API doesn't have full support but it's pretty close. Speech Detection is nearly as instantaneous (depending on the model), but not as accurate as Google Chrome's Cloud API. The extension icon color/indicator changes depending on the process so pin it to your menu to verify the extension is working as intended. A red mic/error icon does not necessarily mean your mic isn't working but rather the speech may have been cancelled by user input, missing cloud API key, or that it is unintelligible (usually its the latter).</li><li>Make sure you are using the correct mic and speak loud, slow, and clear otherwise your voice may not be detected or unintelligible. Change the default model to the cloud or slightly larger or different local ones if you experience problems with voice recognition (this may impair performance). You can also try enabling "boost microphone gain" if you are a soft speaker. If you are constantly processing audio over 1-2 mins, disable the ultimatum processing timeout feature in the settings.</li><li>If you're using Duolingo or similar and are trying to do the speaking practice of the language that you are learning, it is recommended to set the language in the extension to the one you are learning (navigate to the site -> click extension icon -> set language then click "save for site"). This isn't required but it will significantly improve the accuracy of your speech since the model now knows the exact language you are trying to speak. (This isn't exactly necessary for every site, one example is google translate which tells us the exact language that is being used through the input box's data so auto-detect works fine). Look at the images for more help.</li><li>You can also use my <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/a990f5177d19f5c7047476b1038c39c8fbec9e83aa666bf04ba27aca667b5ddf/https%3A//greasyfork.org/en/scripts/568183-speech-recognition-polyfill-userscript/" rel="nofollow">Speech Recognition Polyfill Userscript</a> as an alternative for simplicity/accuracy, or cross-browser compatibility purposes, but the extension is overall better and isn't that complicated to use anyways. This userscript provides one-to-one equivalent speech recognition results when compared to Google Chrome's backend implementation when using the "v1" provider (I think chrome uses this exact endpoint that I reverse engineered lol) in the userscript config. The "v2" provider is more accurate and supports grammar, thought its only SLIGHTLY slower due to technical limitations. Language support with this userscript is not fully known but likely wide-ranging.</li></ul> <code>❗ Caveats:</code> <ul><li>8GB of RAM is a minimum requirement since it could easily take up to a decent chuck when utilizing larger models.</li><li>A modern CPU/GPU is recommended.</li><li>An internet connection is required overall, but especially before using offline mode since the model needs to cache itself first. </li><li>Not being illiterate and reading the <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/a74c7983d5f674ee31ee4482e9845fea894dca61c721e2eaef26898267d53b0c/https%3A//github.com/apersongithub/Speech-Recognition-Polyfill%3Ftab=readme-ov-file%23frequently-asked-questions--model-info" rel="nofollow">FAQ</a> before making a review.</li><li>Understanding that implementing the Web Speech API perfectly isn't feasible and that this extension has more support than anything else available.</li></ul> Even though the model runs locally, the extension re-downloads it either when idle or after closing the tab/opening a new one that utilizes the extension (for memory preservation purposes). This is ultimately better than packaging the large models within the extension for the time being and for most models, the download speed will be near instant for the general population. We also have an option in settings to keep the default model cached without re-downloading every time. Its basically locally offline as long as you use the caching option and don't close the browser or switch models. Apart from locally you can use the cloud based model which is less hardware intensive. The extension will take ~1GB of ram on normal/cloud models and up to ~7GB if you use the biggest model (you don't need to use the biggest model lol). I've implemented decent memory management to compensate.

Detailed Findings

66 total

YARA Rule Matches

10 rules

Indicators of Compromise

Network indicators, suspicious strings, and potential IoCs extracted during analysis

URLs

IP Addresses

Domains

Strings

104

All Indicators · 104

URL

detected URL: https://cdn.jsdelivr.net;

XIOC detected URL: https://cdn.jsdelivr.net;

extracted_from_files

Domain

detected Domain: tab.id

XIOC detected Domain: tab.id

extracted_from_files

URL

detected URL: https://api.assemblyai.com

XIOC detected URL: https://api.assemblyai.com

extracted_from_files

URL

detected URL: https://streaming.assemblyai.com

XIOC detected URL: https://streaming.assemblyai.com

extracted_from_files

URL

detected URL: https://huggingface.co

XIOC detected URL: https://huggingface.co

extracted_from_files

URL

detected URL: https://cdn.huggingface.co

XIOC detected URL: https://cdn.huggingface.co

extracted_from_files

URL

detected URL: https://*.hf.co

XIOC detected URL: https://*.hf.co

extracted_from_files

URL

detected URL: https://api.assemblyai.com/v2/transcript/$

XIOC detected URL: https://api.assemblyai.com/v2/transcript/$

extracted_from_files

URL

detected URL: https://streaming.assemblyai.com/v3/token?$

XIOC detected URL: https://streaming.assemblyai.com/v3/token?$

extracted_from_files

URL

detected URL: http://www.w3.org/2000/svg'

XIOC detected URL: http://www.w3.org/2000/svg'

extracted_from_files

URL

detected URL: http://www.w3.org/2000/svg

XIOC detected URL: http://www.w3.org/2000/svg

extracted_from_files

URL

detected URL: http://mozilla.org/MPL/2.0/.

XIOC detected URL: http://mozilla.org/MPL/2.0/.

extracted_from_files

URL

detected URL: https://ccoreilly.github.io

XIOC detected URL: https://ccoreilly.github.io

extracted_from_files

URL

detected URL: https://cdn.jsdelivr.net

XIOC detected URL: https://cdn.jsdelivr.net

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-ru-0.4.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-ru-0.4.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-tr-0.3.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-tr-0.3.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-vn-0.3.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-vn-0.3.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-en-us-0.22.tar.gz']

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-en-us-0.22.tar.gz']

extracted_from_files

URL

detected URL: https://alphacephei.com/vosk/models/model-list.json';

XIOC detected URL: https://alphacephei.com/vosk/models/model-list.json';

extracted_from_files

URL

detected URL: https://api.assemblyai.com/v2/upload',

XIOC detected URL: https://api.assemblyai.com/v2/upload',

extracted_from_files

URL

detected URL: https://api.assemblyai.com/v2/transcript',

XIOC detected URL: https://api.assemblyai.com/v2/transcript',

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-en-in-0.4.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-en-in-0.4.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-en-us-0.15.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-en-us-0.15.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-es-0.3.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-es-0.3.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-fa-0.4.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-fa-0.4.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-fr-pguyot-0.3.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-fr-pguyot-0.3.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-it-0.4.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-it-0.4.tar.gz'],

extracted_from_files

Domain

detected Domain: window.top

XIOC detected Domain: window.top

extracted_from_files

URL

detected URL: https://github.com/apersongithub/Speech-Recognition-Polyfill

XIOC detected URL: https://github.com/apersongithub/Speech-Recognition-Polyfill

extracted_from_files

URL

detected URL: https://cdn.jsdelivr.net/npm/@xenova/[email protected]';

XIOC detected URL: https://cdn.jsdelivr.net/npm/@xenova/[email protected]';

extracted_from_files

URL

detected URL: https://cdn.jsdelivr.net/npm/[email protected]/dist/vosk.js

XIOC detected URL: https://cdn.jsdelivr.net/npm/[email protected]/dist/vosk.js

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-malayalam-bigram.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-malayalam-bigram.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-ca-0.4.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-ca-0.4.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-cn-0.3.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-cn-0.3.tar.gz'],

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-de-0.15.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-de-0.15.tar.gz'],

extracted_from_files

Domain

detected Domain: b.id

XIOC detected Domain: b.id

extracted_from_files

Domain

detected Domain: tr.dataset.host

XIOC detected Domain: tr.dataset.host

extracted_from_files

Domain

detected Domain: a.download

XIOC detected Domain: a.download

extracted_from_files

Domain

detected Domain: a.click

XIOC detected Domain: a.click

extracted_from_files

Domain

detected Domain: e.data

XIOC detected Domain: e.data

extracted_from_files

Domain

detected Domain: results.map

XIOC detected Domain: results.map

extracted_from_files

URL

detected URL: http://addons.mozilla.org/ca/crl.pem0N

XIOC detected URL: http://addons.mozilla.org/ca/crl.pem0N

extracted_from_files

Domain

detected Domain: www.assemblyai.com

XIOC detected Domain: www.assemblyai.com

extracted_from_files

Hash

detected MD5 Hash: 410171716803f9da6cc5392e1b6d9c2c

XIOC detected MD5 Hash: 410171716803f9da6cc5392e1b6d9c2c

extracted_from_files

Domain

detected Domain: t.id

XIOC detected Domain: t.id

extracted_from_files

Domain

detected Domain: list.map

XIOC detected Domain: list.map

extracted_from_files

Domain

detected Domain: m.id

XIOC detected Domain: m.id

extracted_from_files

Domain

detected Domain: prettyinput.id

XIOC detected Domain: prettyinput.id

extracted_from_files

Domain

detected Domain: model.id

XIOC detected Domain: model.id

extracted_from_files

Domain

detected Domain: collapse-body.open

XIOC detected Domain: collapse-body.open

extracted_from_files

Domain

detected Domain: status.show

XIOC detected Domain: status.show

extracted_from_files

Domain

detected Domain: mozilla.org

XIOC detected Domain: mozilla.org

extracted_from_files

Domain

detected Domain: huggingface.co

XIOC detected Domain: huggingface.co

extracted_from_files

Domain

detected Domain: cdn.huggingface.co

XIOC detected Domain: cdn.huggingface.co

extracted_from_files

Domain

detected Domain: hf.co

XIOC detected Domain: hf.co

extracted_from_files

Domain

detected Domain: s3.amazonaws.com

XIOC detected Domain: s3.amazonaws.com

extracted_from_files

Domain

detected Domain: www.example.com

XIOC detected Domain: www.example.com

extracted_from_files

Domain

detected Domain: message.data

XIOC detected Domain: message.data

extracted_from_files

Domain

detected Domain: xhr.open

XIOC detected Domain: xhr.open

extracted_from_files

Domain

detected Domain: div.id

XIOC detected Domain: div.id

extracted_from_files

Domain

detected Domain: permerror.name

XIOC detected Domain: permerror.name

extracted_from_files

Domain

detected Domain: destination.stream

XIOC detected Domain: destination.stream

extracted_from_files

Domain

detected Domain: www.w3.org

XIOC detected Domain: www.w3.org

extracted_from_files

Domain

detected Domain: slides.google.com

XIOC detected Domain: slides.google.com

extracted_from_files

Domain

detected Domain: www.duolingo.com

XIOC detected Domain: www.duolingo.com

extracted_from_files

Domain

detected Domain: duolingo.com

XIOC detected Domain: duolingo.com

extracted_from_files

Domain

detected Domain: www.duolingo.cn

XIOC detected Domain: www.duolingo.cn

extracted_from_files

Domain

detected Domain: duolingo.cn

XIOC detected Domain: duolingo.cn

extracted_from_files

Domain

detected Domain: e.target

XIOC detected Domain: e.target

extracted_from_files

Domain

detected Domain: el.id

XIOC detected Domain: el.id

extracted_from_files

Domain

detected Domain: words.map

XIOC detected Domain: words.map

extracted_from_files

detected Domain: transcriptjson.id

XIOC detected Domain: transcriptjson.id

extracted_from_files

Domain

detected Domain: session.ws

XIOC detected Domain: session.ws

extracted_from_files

Domain

detected Domain: websocket.open

XIOC detected Domain: websocket.open

extracted_from_files

Domain

detected Domain: event.data

XIOC detected Domain: event.data

extracted_from_files

Domain

detected Domain: www.google.com

XIOC detected Domain: www.google.com

extracted_from_files

Domain

detected Domain: docs.google.com

XIOC detected Domain: docs.google.com

extracted_from_files

Domain

detected Domain: api.assemblyai.com

XIOC detected Domain: api.assemblyai.com

extracted_from_files

Domain

detected Domain: streaming.assemblyai.com

XIOC detected Domain: streaming.assemblyai.com

extracted_from_files

Domain

detected Domain: msg.id

XIOC detected Domain: msg.id

extracted_from_files

URL

detected URL: https://alphacephei.com

XIOC detected URL: https://alphacephei.com

extracted_from_files

Domain

detected Domain: ctx.save

XIOC detected Domain: ctx.save

extracted_from_files

Domain

detected Domain: colors.download

XIOC detected Domain: colors.download

extracted_from_files

Domain

detected Domain: ms.download

XIOC detected Domain: ms.download

extracted_from_files

Domain

detected Domain: example.com

XIOC detected Domain: example.com

extracted_from_files

Domain

detected Domain: exemplo.com

XIOC detected Domain: exemplo.com

extracted_from_files

Domain

detected Domain: cdn.jsdelivr.net

XIOC detected Domain: cdn.jsdelivr.net

extracted_from_files

Domain

detected Domain: date.now

XIOC detected Domain: date.now

extracted_from_files

Domain

detected Domain: ev.data

XIOC detected Domain: ev.data

extracted_from_files

Domain

detected Domain: ccoreilly.github.io

XIOC detected Domain: ccoreilly.github.io

extracted_from_files

Domain

detected Domain: alphacephei.com

XIOC detected Domain: alphacephei.com

extracted_from_files

detected IP: 120.0.0.0

XIOC detected IP: 120.0.0.0

extracted_from_files

Domain

detected Domain: signingca1.addons.mozilla.org

XIOC detected Domain: signingca1.addons.mozilla.org

extracted_from_files

Domain

detected Domain: mozilla.com

XIOC detected Domain: mozilla.com

extracted_from_files

Domain

detected Domain: addons.mozilla.org

XIOC detected Domain: addons.mozilla.org

extracted_from_files

Domain

detected Domain: content-signature.mozilla.org

XIOC detected Domain: content-signature.mozilla.org

extracted_from_files

Domain

detected Domain: t4e253dc216a5b6e0c6075272080232b2.410171716803f9da6cc5392e1b6d9c2c.addons.mozilla.org

XIOC detected Domain: t4e253dc216a5b6e0c6075272080232b2.410171716803f9da6cc5392e1b6d9c2c.addons.mozilla.org

extracted_from_files

Domain

detected Domain: github.com

XIOC detected Domain: github.com

extracted_from_files

URL

detected URL: https://www.google.com/s2/favicons?domain=$

XIOC detected URL: https://www.google.com/s2/favicons?domain=$

extracted_from_files

URL

detected URL: https://www.assemblyai.com/dashboard/api-keys',

XIOC detected URL: https://www.assemblyai.com/dashboard/api-keys',

extracted_from_files

URL

detected URL: https://github.com/apersongithub/Speech-Recognition-Polyfill/tree/main/prebuilt-overrides

XIOC detected URL: https://github.com/apersongithub/Speech-Recognition-Polyfill/tree/main/prebuilt-overrides

extracted_from_files

URL

detected URL: https://*.s3.amazonaws.com;

XIOC detected URL: https://*.s3.amazonaws.com;

extracted_from_files

detected IP: ::

XIOC detected IP: ::

extracted_from_files

URL

detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-pt-0.3.tar.gz'],

XIOC detected URL: https://ccoreilly.github.io/vosk-browser/models/vosk-model-small-pt-0.3.tar.gz'],

extracted_from_files

Security Analysis Summary

Security Analysis Overview

Speech Recognition Polyfill (STT) is a Firefox Add-ons extension published by apersongithub. Version 1.5.6 has been analyzed by the Risky Plugins security platform, receiving a risk score of 100/100 (CRITICAL risk) based on 171 security findings.

Risk Assessment

This extension presents critical security risk. Severe issues were detected, potentially including malware indicators, exposed secrets, or dangerous behaviors. Installation is strongly discouraged until these issues are addressed.

Findings Breakdown

High: 54 finding(s)
Medium: 117 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

Malware Detection: YARA rule matching against 2,400+ malware signatures
Secret Detection: Scanning for exposed API keys, tokens, and credentials
Static Analysis: Code-level security analysis for common vulnerability patterns
Network Analysis: Detection of suspicious network communications and endpoints
Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

Speech Recognition Polyfill (STT) is published by apersongithub on the Firefox Add-ons marketplace. The extension has approximately 40 users.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

Duoblock Origin

apersongithub

CRITICAL 11 users

Duolingo Max

apersongithub

CRITICAL 229 users

Duolingo Max

apersongithub

HIGH 1K users

SN Utils

Arnoud Kooi

CRITICAL 3K users

Traducteur PIKA

Détective Pikachu

CRITICAL 65 users

IntelliBuddies Web Automation

IntelliBuddies

CRITICAL 3 users

Risk Assessment

Severity Breakdown

Finding Categories

YARA Rules Matched

Requested Permissions

About This Extension

Detailed Findings

NET-FETCH-background.js-727

NET-FETCH-options.js-288

NET-FETCH-popup.js-179

NET-WEBSOCKET-background.js-1457

MANIFEST-SENSITIVE-PERM-TABS

MANIFEST-SENSITIVE-PERM-<ALL_URLS>

NET-FETCH-background.js-1318

NET-FETCH-background.js-1304

NET-FETCH-background.js-1392

NET-FETCH-background.js-1345

NET-FETCH-background.js-178

NET-XMLHTTPREQUEST-content.js-959

YARA Rule Matches

postinstall persistence mechanism

NoUseWeakRandom

postinstall system command

postinstall obfuscation

postinstall network communication

postinstall file manipulation

AlertStatementsShouldNotBeUsed

postinstall file download

postinstall crypto operations

OriginsNotVerified

Indicators of Compromise

All Indicators · 104

Security Analysis Summary

Security Analysis Overview

Risk Assessment

Findings Breakdown

What Was Analyzed

Developer Information

Recommendation

Frequently Asked Questions

Similar Extensions

Duoblock Origin

Duolingo Max

Duolingo Max

SN Utils

Traducteur PIKA

IntelliBuddies Web Automation