Is D365 Finance & Operations Dev Tools safe?
We analyzed D365 Finance & Operations Dev Tools version 0.0.0.7's actual code and gave it a 62/100 trust score. This is a mostly purpose-aligned developer…
Bottom line
This is a mostly purpose-aligned developer tool, but its automatic clipboard access creates a meaningful privacy and disclosure risk.
What it can access
The tool’s active-tab and storage access fit its D365 purpose, but automatic clipboard reading can capture unrelated sensitive data. [Q1][Q5][Q15]
Security weaknesses
Automatically pasting clipboard contents into navigation fields can cause accidental disclosure when the user opens a destination. [Q5][Q15][Q24]
Signs of misuse
No deliberate tracking or remote control is shown, but clipboard data may be sent to a chosen D365 site after the user opens it. [Q6][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests activeTab, storage, and clipboardRead. It has no website access, background worker, or page access, so it operates only when its popup is opened and the user grants the active-tab context.
Declares only the popup and the three permissions. — manifest.json:4-27
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Contains no content_scripts or scripting permission. — manifest.json:4-27
Uses tabs.create/update rather than modifying the page DOM. — popup.js:41-48
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
When the popup opens, it reads the active tab URL, extracts its origin, and reads the cmp query parameter to pre-fill the D365 base URL and company. It does not inspect the page's page or arbitrary content.
Queries the active tab and parses currentTab.url into origin and cmp. — popup.js:121-134
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It saves previously used D365 base URLs in chrome.storage.sync for autocomplete. That browser facility can synchronize the values through the user's Chrome account; company, class, form, table, and clipboard values are not explicitly stored.
Reads and writes only the base_url list through chrome.storage.sync. — popup.js:50-71, 136-164
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It requests clipboardRead and, on popup load, focuses each text field and invokes document.execCommand('Paste'). This can place unrelated clipboard contents into extension fields without the user choosing Paste inside a specific field.
Requests clipboardRead. — manifest.json:7-11
Loops through every input, focuses it, and executes the Paste command. — popup.js:188-199
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
After the user clicks Open, field values are encoded into a URL and sent to the user-entered D365 base URL through normal navigation. Saved base URLs also go to Chrome sync storage.
Builds query parameters from company/table/class/form fields and opens the resulting base URL. — popup.js:3-48
Stores the used base URL in chrome.storage.sync. — popup.js:50-71
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Contains no fetch, XHR, WebSocket, remote import, or resource download. — popup.js:1-200
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
Declares only an action popup, with no background or content script. — manifest.json:4-27
All setup occurs in the popup's DOMContentLoaded handler. — popup.js:121-199
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no browser-setting or management capabilities. — manifest.json:4-27
Presents explicit Open in current/new tab actions. — popup.html:111-121
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The application logic is plain, commented JavaScript. The included 62 KB Material Design Lite library is minified, but it is standard packaged UI code and the extension's security behavior does not depend on opaque custom logic.
Readable application flow with descriptive function and field names. — popup.js:1-200
Minified packaged Material Design Lite widget library. — assets/js/material.min.js:complete file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Targeted dynamic-code search found none. — popup.js, assets/js/material.min.js:complete scripts
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Performs one active-tab query inside the popup initialization. — popup.js:121-134
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Stores only entered base URLs. — popup.js:50-71
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
No cookies or identity permission is declared. — manifest.json:7-11
Constructs a URL without accessing authentication material. — popup.js:3-48
Does it record typing, form entries, clipboard contents, or screenshots?
It can read clipboard content through automatic Paste commands and place it into visible fields. It otherwise reads only popup inputs and the active tab's URL; it does not monitor website keystrokes, forms, messages, screenshots, camera, or microphone.
Focuses each popup input and invokes Paste. — popup.js:188-199
Reads the popup's base URL, company, table, class, and form values. — popup.js:7-39, 74-108
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Contains no remote messaging, response handling, or runtime message listener. — popup.js:1-200
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Navigation is tied directly to the three advertised developer tools. — popup.js:3-48
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest or declarativeNetRequest permission is declared. — manifest.json:7-11
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or host permission is declared. — manifest.json:7-11
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
No fetch or text-to-code execution exists. — popup.js:1-200
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains only a popup action and local permissions. — manifest.json:4-27
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
All decisions come from the selected tab, active popup panel, visible fields, and explicit clicks. — popup.js:3-48, 121-199
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
No background or content process is declared. — manifest.json:4-27
Popup event handlers perform bounded local work. — popup.js:121-199
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Constructs the destination from form values and calls tabs.create or tabs.update. — popup.js:3-48
Validates only nonempty values. — popup.js:74-119
Clipboard paste may populate one or more navigation fields. — popup.js:188-199