Is Markdown Editor safe?
We analyzed Markdown Editor version 0.5.1's actual code and gave it a 82/100 trust score. This appears to be a narrowly scoped Markdown editor with no…
Bottom line
This appears to be a narrowly scoped Markdown editor with no established misuse, but it relies on one remotely loaded caching component.
What it can access
It requests only tab management and reads user-selected Markdown files, which fits a local editor. [Q1][Q5]
Security weaknesses
A secondary caching worker loads code from an external service, creating supply-chain risk despite no demonstrated remote commands. [Q20][Q16]
Signs of misuse
No evidence shows collection of browser data, tracking, page changes, or remote control. [Q14][Q16][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests the tabs permission to find, create and focus its own editor tab. The code does not inspect other tabs' URLs or contents.
Requests only the tabs permission and declares no host access or content scripts. — manifest.json:1-29
Queries specifically for the extension's own index.html URL, then focuses or creates that tab. — worker.js:1-10
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines only an extension-owned editor page and background worker. — manifest.json:1-29
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
No site access or content script is declared. — manifest.json:1-29
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The only permission is tabs. — manifest.json:1-29
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads a Markdown file only after the user chooses or drops it into the editor. It does not receive general filesystem access.
Uses FileReader.readAsText on the user-selected .md file. — App/Components/Header/Upload.js:5-18
Accepts a dropped file only when its name ends in .md. — App/Container/Hooks/useDrop.js:19-40
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Markdown can render remote images or user-clicked links embedded in the document, causing normal requests to those document-supplied destinations. The editor does not upload the Markdown text.
Renders user Markdown with HTML and automatic links enabled. — App/Components/Markdown/Previewer/Preview.js:15-23
Loaded file text is passed directly into the local editor rather than a network client. — App/Components/Header/Upload.js:5-18
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Initial and saved editor state comes from packaged text and localStorage. — App/Container/Hooks/useText.js:1-9
No host permissions permit extension-origin cross-site fetches. — manifest.json:1-29
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically saves editor changes locally and attempts to register a cache service worker. It does not automatically upload the document.
Loads editor.content from localStorage and saves every edit back there. — App/Components/Markdown/Editor/MirrorEditor.js:9-24
Calls serviceWorkerRegistration.register after rendering the editor. — App/index.js:1-20
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No settings-related permission is requested. — manifest.json:1-29
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains the original application filenames and sourcesContent. — static/js/main.a9d69fdd.chunk.js.map:1
The complete privileged background logic is readable. — worker.js:1-10
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The sole new Function occurrence is a standard global-object compatibility helper. — static/js/3.2af96601.chunk.js:2
Markdown is passed to the renderer rather than evaluated as JavaScript. — App/Components/Markdown/Previewer/Preview.js:1-24
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses chrome.tabs.query only with chrome.runtime.getURL('index.html'). — worker.js:1-10
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Local storage contains only the editor.content draft. — App/Components/Markdown/Editor/MirrorEditor.js:9-24
Background logic contains no analytics or identifier generation. — worker.js:1-10
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies or host permission. — manifest.json:1-29
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No capture, clipboard or site-access permission is declared. — manifest.json:1-29
Handles changes only inside its own CodeMirror editor. — App/Components/Markdown/Editor/MirrorEditor.js:11-27
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no content script, externally_connectable entry or host access. — manifest.json:1-29
Listens only for a click on the extension action. — worker.js:1-10
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No content script or host access is present. — manifest.json:1-29
Renders the supplied document inside the editor page's React component. — App/Components/Markdown/Previewer/Preview.js:15-23
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
The Print as PDF control calls window.print after temporarily setting the document title. — App/Components/Header/index.js:5-25
File contents are read into the local editor. — App/Components/Header/Upload.js:5-18
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is requested. — manifest.json:1-29
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Calls importScripts on https://storage.googleapis.com/workbox-cdn/releases/4.3.1/workbox-sw.js before loading the packaged precache manifest. — service-worker.js:14-18
Automatically invokes the Create React App web-service-worker registration helper. — App/index.js:1-20
Manifest V3 uses worker.js as the actual extension background worker and declares no relaxed CSP or Google host permission. — manifest.json:1-29
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No content script or externally_connectable interface exists. — manifest.json:1-29
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Feature-detects navigator.serviceWorker and tries to register the packaged service-worker.js after page load. — App/serviceWorkerRegistration.js:21-58
The remote import occurs only inside that attempted secondary worker. — service-worker.js:14-18
The package is Manifest V3 and has a different packaged background service worker. — manifest.json:1-29
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The complete background worker only opens or focuses the editor. — worker.js:1-10
The application initializes the editor and caching helper only. — App/index.js:1-20
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No visited-page access exists. — manifest.json:1-29
Its only file input belongs to the extension's own editor and accepts a user-selected .md file. — App/Components/Header/Upload.js:21-48