Is Dark Mode - Night Eye safe?
We analyzed Dark Mode - Night Eye version 6.1.1's actual code and gave it a 58/100 trust score. This is a purpose-aligned dark-mode extension with broad…
Bottom line
This is a purpose-aligned dark-mode extension with broad website access, persistent device reporting, and exposed support features that create meaningful privacy and security concerns.
What it can access
The extension runs on all websites and every frame, where it can read visual page structure and change appearance. [Q1] [Q2] It also uses theme-related storage, persistent device information, and optional account sign-in data. [Q4] [Q6]
Security weaknesses
Any website can use the exposed support feature without verified sender checks, potentially sending messages under stored account details. [Q21] Page-controlled resource requests can also reach private-network services without adequate address checks. [Q19]
Signs of misuse
The extension sends persistent device, installation, licensing, and usage-state information to its services, which is broader than the visual feature itself. [Q6] [Q13] There is no evidence of website-visit tracking or authentication-data collection beyond the stated sign-in flow. [Q12] [Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests all-site host access, tabs, scripting and identity, and runs in every frame from document start. Most of that supports whole-web dark mode; identity is used for optional paid-account login.
Declares tabs, scripting and identity, runs content.js on <all_urls> in all frames, and grants *://*/* host access. — manifest.json:17-25, 68-81
Google OAuth scope is limited to userinfo.email. — manifest.json:100-105
Which websites can it run on, and can it read or change what appears on those pages?
It reads stylesheets, inline styles, images and page structure and continuously rewrites visual page/CSS state. It also contains site-specific native-theme integrations.
The converter walks DOM/style rules, observes mutations, changes colors/images and injects generated styles. — js/content/content.js:6
The content engine loads in every frame before normal page execution completes. — manifest.json:68-77
Packaged site-specific CSS supplements the generic converter. — css/websites.css:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Input/textarea handling concerns color and background styling; no field-value collection or transmission path was found. — js/content/content.js:6
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads and writes non-authentication theme cookies and local-storage values on many supported sites. It does not request Chrome cookie, history, bookmark or download services.
Built-in theme handlers read/write cookies such as YouTube PREF, TikTok theme, LinkedIn li_theme and multiple site local-storage theme keys. — js/content/content.js:6
No cookies, history, bookmarks or downloads permission is declared. — manifest.json:17-25
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
No device, file, clipboard, nativeMessaging or management permission is declared. — manifest.json:17-25
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends persistent device/instance IDs, install timestamp, instance name, license flags, extension status, trial-screen timestamp, last dark-mode use and version to billing.nighteye.app. Explicit login additionally sends email/password or Google ID/email; support messages go to relayflow.promotino.com.
checkUsingLicense constructs an InstanceController request containing IDs, install/license flags, timestamps and version. — background.js:3
activateNetworkRequest POSTs instance/device/name plus email, password and Google ID during explicit activation. — background.js:3
Google login retrieves Google ID/email and passes them to the activation flow. — js/browser-action/overview.js:3
The support-message client POSTs identity and message data to relayflow.promotino.com. — background.js:3
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Billing responses are parsed as JSON into fixed license fields. — background.js:3
downloadCSS obtains linked CSS text, resolves @import URLs and adds a style node for the dark-mode converter. — js/content/content.js:6
Manifest V3 extension CSP allows scripts only from self. — manifest.json:83-85
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Dark-mode conversion and license checks run automatically. On supported services it may alter cookies/local storage or authenticated Jira/Confluence theme preferences to match Night Eye without a separate per-site confirmation.
Starts the converter automatically in all page frames at document_start. — manifest.json:68-77
Runs license checking and support-message status checks at browser startup. — background.js:3
Built-in theme handlers automatically synchronize site theme cookies, storage and Jira/Confluence preferences. — js/content/content.js:6
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
updateWebsiteBuiltInTheme_Jira PUTs jira.user.theme.preference and the Confluence handler POSTs theme preference GraphQL mutations. — js/content/content.js:6
No Chrome search, homepage or proxy control permission is declared. — manifest.json:17-25
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Application and dependency code is shipped as large minified Webpack bundles. Names and fixed services remain traceable, but bundling materially increases review difficulty.
Contains the full background application and dependencies in one approximately 229 KB minified line. — background.js:3
Contains the approximately 397 KB converter plus libraries in one minified line. — js/content/content.js:6
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
new Function appears in the bundled global-object/regenerator compatibility helpers. — background.js:3
The duplicated helper is packaged code; remote stylesheet text flows to CSS processing, not Function or eval. — js/content/content.js:6
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
checkUsingLicense sends license/install state and lstdkmapldts but no current tab URL or per-site settings. — background.js:3
URL settings use ws-<site> keys in local Chrome storage. — background.js:3
Does it create a persistent ID or browser fingerprint to recognize you?
It creates stable instance and device identifiers. The device value combines randomness, time and browser language data, is copied into nighteye.app local storage, sent to licensing, and included in the uninstall destination fragment.
generateUniqueDeviceId incorporates Math.random, current time and navigator.languages before base64 encoding. — background.js:3
registerVersion opens a thank-you page and injects nighteye-ins into that site's localStorage. — background.js:3
checkUsingLicense transmits deviceID/instanceID and configures an uninstall URL containing the device ID in its fragment. — background.js:3
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Website cookies read by built-in handlers are theme flags and have no outbound path. — js/content/content.js:6
Activation credentials flow only to the fixed billing.nighteye.app InstanceController endpoint. — background.js:3
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Website input elements are restyled but their values and keystrokes are not collected. — js/content/content.js:6
No clipboard or tab-capture permission is declared. — manifest.json:17-25
Can a website or remote server send commands that make the extension take actions?
Night Eye's license server controls subscription/trial state but not arbitrary extension commands. Separately, any website can invoke the external support-message action and submit attacker-chosen content under stored support identity because sender origin is not validated.
License JSON updates fixed account, plan, expiry and feature-state fields. — background.js:3
onMessageExternal accepts night-eye-create-support-message and forwards payload without checking sender.url or sender.id. — background.js:3
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Context-menu promotional actions open fixed Night Eye store/share destinations after user selection. — background.js:3
Injected page changes concern dark-mode styles and native theme state. — js/content/content.js:6
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No proxy, webRequest, declarativeNetRequest or downloads permission is declared. — manifest.json:17-25
Can it communicate with software on the computer or services running on localhost?
Page-controlled stylesheet and nested @import URLs are sent to an unrestricted background fetch with no scheme or private-address validation. This can trigger blind GET requests to localhost or private-network services, although response text stays inside the converter.
downloadCSS follows page stylesheet URLs and recursively resolved @import URLs through ACTION_FETCH_RESOURCE. — js/content/content.js:6
Resourcer.fetchResource performs fetch(t.url) and returns text without URL validation. — background.js:3
Broad host permission allows cross-origin and private-address requests where browser policy permits. — manifest.json:79-81
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
LZ-string compresses converted CSS and selector cache into localStorage. — js/content/content.js:6
Extension pages restrict script-src to self. — manifest.json:83-85
Can ordinary websites access privileged extension features through messaging or exposed files?
The manifest makes the extension externally connectable from every website. The external handler accepts support-message data without sender validation, allowing sites to submit messages using the user's stored Night Eye support identity.
externally_connectable permits three extension IDs and <all_urls>; multiple resources are web-accessible to all URLs. — manifest.json:48-66
onMessageExternal forwards night-eye-create-support-message payloads through sendExternalSupportMessage without checking sender. — background.js:3
sendExternalSupportMessage uses stored chat ID, email and name when POSTing to Relayflow. — background.js:3
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Branches select packaged transformations by parsed hostname, page type and saved user settings. — js/content/content.js:6
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Recurring work watches style/DOM mutations and recomputes visual colors for the advertised converter. — js/content/content.js:6
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Form elements flow through color/style conversion; no code assigns user field values or rewrites form.action. — js/content/content.js:6