Is Material Icons for GitHub safe?
We analyzed Material Icons for GitHub version 1.16.4's actual code and gave it a 88/100 trust score. This is a purpose-aligned icon customizer with…
Bottom line
This is a purpose-aligned icon customizer with moderate access and no established misuse.
What it can access
It automatically reads repository labels and changes displayed icons on ten named code-hosting sites, matching its stated purpose. [Q1] The extension can request access to another website after approval, broadening its possible reach. [Q2]
Security weaknesses
The reviewed package does not download or execute outside instructions. [Q7] It does not use dangerous text-to-code execution or expose privileged features to ordinary websites. [Q11] [Q21]
Signs of misuse
No evidence shows information being sent outside the browser, tracking of visited sites, or collection of sign-in details. [Q6] [Q12] [Q14] It also does not alter links, advertisements, or search results. [Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It automatically runs on ten named code-hosting services and can run on another hostname only after the user approves that site's permission prompt.
Declares fixed code-host matches, storage, activeTab, scripting, and optional all-site host access. — manifest.json:14-35,41-45,77-79
Requests access to the current hostname and registers the packaged main.js and stylesheet only after permission is granted. — settings-popup.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It reads repository file and folder labels and nearby icon elements to select and display matching packaged icons.
Provider-specific selectors enumerate file-tree rows, extract filenames, and replace their icon nodes. — main.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Observed page reads are confined to provider detection, file and folder labels, and existing icon elements. — main.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores its own per-domain icon settings in browser sync storage; it has no history, cookies, bookmarks, downloads, or password permission.
Requests storage, activeTab, and scripting only. — manifest.json:41-45
Reads and writes icon pack, size, enablement, bindings, and custom provider mappings in storage.sync. — options.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the relevant permissions. — manifest.json:41-45
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
The content script reads DOM labels and selects extension-local SVG URLs; it contains no active network client. — main.js:1
The settings application uses extension storage and local assets, with no analytics or request path. — options.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Provider selectors, icon mappings, and defaults are packaged in the installed script; user overrides come from storage.sync. — main.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically replaces icons when supported repository pages load and watches later page changes; users can disable it per domain.
Loads main.js at document_start on supported sites. — manifest.json:14-35
Initializes icon replacement, observes page mutations, and checks extEnabled settings before acting. — main.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings or network-settings permission. — manifest.json:41-45
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Bundled content script retains identifiable provider, settings, selector, and icon-mapping logic. — main.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Execution is limited to packaged JavaScript; apparent API-name matches occur inside the standard browser polyfill metadata, not calls. — main.js:1
Declares packaged scripts, styles, and SVG resources only. — manifest.json:28-33,47-65
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Matches location.href and location.hostname against fixed or user-selected provider rules and reads filenames for icon selection. — main.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no analytics or network destination; settings are functional icon preferences. — main.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies, webRequest, or identity permission. — manifest.json:41-45
No cookie or token-reading path was found in the content script. — main.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
DOM processing targets repository rows, filenames, folders, and icon nodes rather than input events or values. — main.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
The popup asks for the current hostname, injects packaged main.js once, and registers that same packaged script for future visits. — settings-popup.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Provider handlers replace icon presentation and annotate processed rows; inserted URLs use runtime.getURL for packaged assets. — main.js:1
Describes file-browser icons and exposes packaged SVG files to supported pages. — manifest.json:4-7,47-65
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:41-45
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:41-45
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Provider rules and icon mappings are bundled; configuration comes only from browser sync storage. — main.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable entry. — manifest.json:1-80
Runtime messages accept only internal init and provider-detection commands; there is no window-message relay. — main.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Provides per-domain enablement, icon pack, size, and file/folder binding controls stored in storage.sync. — options.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Runtime work consists of DOM selection, icon matching, and mutation observation. — main.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Writes are confined to file-tree icon elements, attributes used to mark processed rows, and icon styling. — main.js:1