Is FB Multi Manager safe to use?

FB Multi Manager has a security risk score of 54.74/100 (MEDIUM risk). Our security analysis detected 230 findings. Review the detailed security assessment below to understand the specific risks before installation.

What are the security risks of FB Multi Manager?

Based on our automated security analysis, FB Multi Manager presents medium risk level. The extension is analyzed for malware patterns, secret exposure, network communications, permissions, and supply chain vulnerabilities.

How is the security score calculated?

Risky Plugins calculates security scores using weighted categories: severity of findings (25 points max), malware detections (35 points), secret exposure (28 points), network communications (10 points), and obfuscation (10 points). Scores range from 0-100, with higher scores indicating greater risk.

What does CRITICAL, HIGH, MEDIUM, LOW, MINIMAL risk mean?

CRITICAL (80-100): Severe security issues like malware. HIGH (60-79): Significant vulnerabilities. MEDIUM (40-59): Moderate security concerns. LOW (20-39): Minor issues. MINIMAL (0-19): Very low risk. Always review findings before installing any extension.

Tracked campaign: Fb Multi Manager malware

Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →

Also reported by malext.io

Chrome Web Store

FB Multi Manager

by [email protected] · 16 users

ea321946-d37e-5015-a535-86d0dd2742d0 | v1.0.2

Marketplace listing not found

Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.

Not found on Today

MEDIUM risk

+7 since v1.0.1

Threat verdict

Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed: 1 months ago
Version: v1.0.2
Artifact: SHA256 782…DFE
Source: Findings (non-IoC)

Is FB Multi Manager safe?

FB Multi Manager is described as a side-panel tool for Facebook Pages, audience insights, and analytics. It declares no special permissions or host permissions in the available listing. NET-FETCH-background.js-14 and NET-WEBSOCKET-background.js-14 show that background.js:14:0 can make web requests and open a live connection; the listed Facebook services include business.facebook.com and adsmanager.facebook.com.

Those Facebook endpoints fit the stated use. The same extension also lists fb-manager.study, ws.fb-manager.study, 2-t.top, ee-t.top, and n-e.by. If NET-WEBSOCKET-background.js-14 sends Facebook account or Page data to those services, the extension operator could receive information handled through the tool. NET-FETCH-privacy.js-33 at privacy.js:33:0 is another outbound request whose destination and contents are not shown.

No malware signature, malware, obfuscation, or tool-poisoning match was recorded. The scanner also hit many low-severity JavaScript code-smell rules, which do not describe harmful behavior on their own. The unanswered issue is what background.js:14:0 and privacy.js:33:0 send to the non-Facebook domains, so live network testing is needed.

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

192 detail rows

YARA Rule Matches

11 rules

Severity	Rule	Hits	Files	Metadata
LOW	`postinstall environment access`	130	chunks/Home-DVABI_rj.jschunks/Facebook-Dc1ehZ9u.jschunks/Coinbase-C0eYuvPj.js +127 more	-
LOW	`postinstall system command`	5	chunks/sidepanel-euqC2WAj.jsassets/sidepanel-DElvtIg7.cssprivacy.html +2 more	-
LOW	`postinstall crypto operations`	4	background.jschunks/sidepanel-euqC2WAj.js_metadata/verified_contents.json +1 more	-
LOW	`postinstall file manipulation`	6	content-scripts/content.jsprivacy.html_locales/pt_BR/messages.json +3 more	-
LOW	`postinstall registry modification`	1	chunks/sidepanel-euqC2WAj.js	-
LOW	`postinstall obfuscation`	3	_locales/es/messages.jsonbackground.jschunks/sidepanel-euqC2WAj.js	-
LOW	`postinstall network communication`	21	_locales/es/messages.json_locales/de/messages.jsonchunks/sidepanel-euqC2WAj.js +18 more	-
LOW	`postinstall file download`	13	_locales/es/messages.json_locales/it/messages.jsonprivacy.js +10 more	-
LOW	`NoUseWeakRandom`	2	content-scripts/content.jsbackground.js	-
LOW	`credential env files`	1	background.js	-
LOW	`postinstall persistence mechanism`	3	content-scripts/content.jsbackground.js_locales/it/messages.json	-

Show network indicators (38)

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

Noisy-finding weight

x1.00

Publisher domain

No domain

Missing

Store verification signal

Limited signal

Limited

Extension portfolio

Portfolio

13 evidence rows available.

Finding Categories

Network

IoC Indicators

YARA Rules Matched

11 rules(189 hits)

postinstall environment access postinstall system command postinstall crypto operations postinstall file manipulation postinstall registry modification postinstall obfuscation postinstall network communication postinstall file download NoUseWeakRandom credential env files postinstall persistence mechanism

Requested Permissions

5 permissions

*://*/*

Dangerous

storage

Low

sidePanel

Low

declarativeNetRequest

Low

https://*.facebook.com/*

Low

AI Security Report

AI Security Review

Evidence context: threat category data exfiltration; evidence quality moderate.

FB Multi Manager is described as a Chrome side panel for Facebook Page posts, audience insights, and analytics. Its network findings are concentrated in background.js:14:0, where NET-FETCH-background.js-14 and NET-WEBSOCKET-background.js-14 identify both HTTP fetch and WebSocket use. The listed Facebook endpoints, including business.facebook.com, adsmanager.facebook.com, and www.facebook.com, fit a tool that works with Facebook Pages and advertising accounts. The extension declares no permissions or host permissions, so the available material does not show a broad manifest grant for reading every website.

The concern is the set of non-Facebook destinations associated with the same extension: fb-manager.study, ws.fb-manager.study, 2-t.top, ee-t.top, i-c.top, n-e.by, scoping.business, and uo.direct. NET-WEBSOCKET-background.js-14 at background.js:14:0 is especially relevant because WebSockets keep a two-way channel open after a page loads. The record does not include request bodies, server responses, or code surrounding background.js:14:0, so it does not establish whether ws.fb-manager.study carries account analytics, login data, routine product traffic, or something else. NET-FETCH-privacy.js-33 at privacy.js:33:0 also shows that a file named privacy.js makes a network request, while its destination and payload are not provided.

There are no matched malware signatures, no malware detections, no obfuscation findings, and no tool-poisoning findings in the scanned material. That limits the case for calling this confirmed harmful software. The large group of low-severity code-smell matches has no named malicious behavior attached here, and such rules commonly trigger on ordinary JavaScript patterns. The concern rests instead on the concrete third-party domains listed beside NET-FETCH-background.js-14, NET-WEBSOCKET-background.js-14, and NET-FETCH-privacy.js-33, rather than on finding volume.

A skeptic could reasonably argue that fb-manager.study and ws.fb-manager.study are the service backend for FB Multi Manager, while business.facebook.com and adsmanager.facebook.com show the intended Facebook workflow. That reading remains possible because the description names Facebook management and background.js:14:0 contains the expected network primitives. It does not explain the separate endpoints 2-t.top, ee-t.top, i-c.top, n-e.by, scoping.business, and uo.direct, nor does the available material identify their owner or purpose. Runtime capture of requests from background.js:14:0 and privacy.js:33:0 is needed to identify transmitted fields and determine whether these domains receive Facebook account or Page data.

Key Reasons

background.js:14:0 has both fetch and WebSocket findings.
The extension lists unexplained third-party endpoints including 2-t.top, ee-t.top, n-e.by, and uo.direct.
privacy.js:33:0 contains an outbound fetch finding with no request details provided.
Facebook endpoints business.facebook.com and adsmanager.facebook.com fit the stated Facebook-management function.
No malware signatures, malware findings, obfuscation findings, or tool-poisoning findings were recorded.

False Positive Considerations

Low-severity code-smell detections lack a named malicious action.
Facebook endpoints such as business.facebook.com and adsmanager.facebook.com fit the stated purpose.
No malware-signature or obfuscation finding is present.

Reviewed 2026-09-27; recommended action: runtime analysis; model confidence 72%.

Chrome version history

Risk trend by version

3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.

Selected

Change since first

+16

Change from previous

Versions:

First analyzed version

1.0.0

Aug 13, 2026

Risk range

38 to 55

Across analyzed versions

Latest analyzed version

1.0.2

Sep 26, 2026

Selected version

medium

Version

v1.0.2

1 months ago

Risk score

Findings

230

Change vs previous

Pick any point on the chart to explore that version's code below.

Source Code Viewer

Source Code Not Available

Source code is not available for this version of the extension.

About This Extension

Review Facebook Page performance without repeatedly switching between Meta Business Suite screens. FB Multi Manager places recent posts, audience insights, and practical performance metrics in a focused Chrome side panel next to the Facebook tab where you already work. WHAT YOU CAN DO • Switch between Business portfolios and their connected Facebook Pages. • Review recent posts with views, viewers, interactions, reactions, comments, shares, saves, follows, and link clicks. • Open a post to inspect its performance over time, follower and non-follower audience split, age and gender distribution, and leading countries. • Compare the daily view performance of several Pages in one visual chart. • Jump to official Meta tools to create a post, ad, Reel, or Story. • Use the interface in 16 languages, with automatic browser-language detection and a saved manual preference. DESIGNED FOR A FOCUSED WORKFLOW FB Multi Manager is useful for marketers, founders, agencies, and social media teams that manage multiple Facebook Pages and want important read-only insights close at hand. The current release focuses on Page and post analytics. Unavailable functions, including advertising management, Reach comparison, and additional preferences, are clearly marked as coming soon. PRIVACY BY DESIGN The extension uses your existing Facebook session. Authentication data is cached only in Chrome local extension storage and sent only to Meta-owned Facebook endpoints over HTTPS. Open Facebook tab URLs are checked locally only to detect the current Business and Page context. Analytics and authentication data are not sent to a developer-operated server, sold, or used for advertising. FB Multi Manager is an independent product and is not affiliated with, endorsed by, or sponsored by Meta or Facebook.