Is Zing Trade safe?
We analyzed Zing Trade version 1.2.11's actual code and gave it a 52/100 trust score. This is a powerful trading assistant with broad financial-site…
Bottom line
This is a powerful trading assistant with broad financial-site access and meaningful control over signed-in trading pages; its purpose is plausible, but users should treat it as high access risk.
What it can access
It can operate across a very large list of broker and exchange sites, read authentication cookies, and influence trades [Q2][Q4][Q14][Q24]. This is substantially broader and more powerful than a simple chart-signal display, although the site scope matches its trading purpose [Q2][Q24].
Signs of misuse
The package sends authentication-related data and telemetry to its service [Q6][Q14], while supported pages or remote signals can trigger privileged requests and trading operations without a fresh click [Q16][Q24]. No downloaded-code execution or universal browsing surveillance was established [Q11]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests broad access across many broker and cryptocurrency-exchange websites, including access to authentication cookies and the ability to affect trading activity. This generally fits its stated trading-signal purpose, but the scope and power are unusually extensive.
The manifest requests cookies, tabs, notifications, side-panel and background-operation access, declarative traffic control, and access to a very large list of broker, exchange, charting, and service websites. — manifest.json:1
Content scripts run in all frames on many supported trading sites, including some in the page's main execution context. — manifest.json:1
The service worker reads authentication cookies for supported brokers and stores or uses session information. — 4c1c5d0832e4.js:1
Trading-page integrations pass order parameters to broker adapters, while related files can submit or exit positions. — 0a37d116e4fb.js:208
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: https://*.lemonn.co.in/*, wss://*.lemonn.co.in/*, https://*.peepal.co/*, https://*.coinswitch.co/*, wss://*.coinswitch.co/*, https://zing.trade/*, https://*.zing.trade/*, https://*.5paisa.com/* — manifest.json:1
Content scripts run directly on: *://tv.lemonn.co.in/*, *://canary-tv.lemonn.co.in/*, *://tv.dhan.co/*, *://*.dhan.co/*, *://web.dhan.co/*, *://tv.upstox.com/*, *://*.upstox.com/*, *://kite.zerodha.com/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension can read authentication cookies and page API responses on supported trading sites, but the reviewed code does not establish that it captures passwords, payment details, messages, or arbitrary form entries. The large minified runtime leaves some page-data behavior unresolved.
Scripts run in isolated or MAIN world on many broker and exchange origins, including all frames. — manifest.json:content_scripts entries
The service worker reads supported-site authentication cookies and receives page messages. — 4c1c5d0832e4.js:1
The cited page hook reads Zerodha authentication cookies, not general typed form values. — d645e90d9259.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension accesses private browser data, especially authentication cookies for supported trading sites, and stores or uses session information. There is no evidence that it reads browsing history, bookmarks, or downloads.
The extension requests cookies and tabs permissions with broad broker host access. — manifest.json:permissions and host_permissions
chrome.cookies.get reads Lemonn authentication cookies and synchronizes them into extension storage. — 4c1c5d0832e4.js:1
The worker queries tabs and uses tab URLs, activation, and update events. — 4c1c5d0832e4.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends telemetry, authentication-related data, trading information, and requests to Zing/Peepal and broker or exchange services. It also maintains signal connections and forwards page-originated requests through the service worker.
The worker calls Peepal broker-status and authentication endpoints, opens signal connections, and implements an http_fetch handler. — 4c1c5d0832e4.js:1
Install, login, user-information, and diagnostic events are sent to extension services. — 5a64cd95b477.js:1
The bundled runtime initializes a Peepal/NATS signal connection. — 79332ed194ce.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
Remote servers supply trading signals, broker-status settings, and other operational data that the extension consumes. The reviewed runtime does not show remote JavaScript execution, but remote settings can change reload and trading-related behavior.
Remote broker-status data is parsed, stored, and can cause matching broker tabs to reload. — 4c1c5d0832e4.js:1
The worker imports bundled local scripts rather than importing remote JavaScript. — 4c1c5d0832e4.js:1
Signal and strategy data are received through remote HTTP/WebSocket services. — ee09367c33c7.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension performs background actions without a fresh click, including periodic requests, signal refreshes, tab checks, notifications, reloads, and conditional sidebar opening. Some actions are restricted to supported broker tabs or stored settings.
Alarms, tab events, focus changes, startup, and storage changes trigger refreshes and broker reconciliation. — 4c1c5d0832e4.js:1
The worker creates or reloads tabs through relaunch and open-or-focus handlers. — 4c1c5d0832e4.js:1
A daily alarm arms conditional automatic sidebar opening. — 4c1c5d0832e4.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the extension uses many hashed/minified files, a roughly 1.9 MB MAIN-world bundle, and bundled third-party networking libraries. This is an inspectability concern, not evidence that the code is malicious.
The file is approximately 1,946,309 bytes and is loaded in MAIN world on many sites. — 3a0d26af84af.js:1
Many hashed scripts and vendor libraries are loaded across broad site matches. — manifest.json:content_scripts entries
The service worker imports numerous hashed modules and vendor networking/serialization libraries. — 4c1c5d0832e4.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
The targeted source search found no use of eval() or new Function(), and the extension CSP also disallows unsafe executable script sources for extension pages. Because much of the code is minified and runtime coverage is incomplete, this is not a guarantee for every unreachable or dynamically assembled path.
The extension-page CSP specifies script-src 'self' and does not allow unsafe-eval. — manifest.json:1-1
The inspected vendor code is ordinary bundled library code; no identified eval or new Function call was found in the targeted search. — vendor/sortable.min.js:1-2
The service worker imports bundled scripts rather than visibly evaluating downloaded text. — 4c1c5d0832e4.js:1
Does it track the websites, pages, searches, or links you visit?
The extension observes supported broker tabs, focus, page-load, signal, and diagnostic events, and sends some telemetry. The evidence establishes activity monitoring for extension operation, but not complete tracking of every website, search, or link visited.
The worker listens to tab updates, activation, focus, removal, and alarms for supported broker tabs. — 4c1c5d0832e4.js:1
Install/login/user-information telemetry includes device, broker, user, and extension details. — 5a64cd95b477.js:1
Diagnostic reporting records runtime and device metrics. — d4b9c2c569ed.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
The extension creates or stores persistent device and account identifiers and sends them with service requests or telemetry. This lets its services recognize an installation or account across sessions.
Requests use stored bolt session/user values and device MAC-derived identifiers such as X-Mac-Id. — 4c1c5d0832e4.js:1
The runtime collects device characteristics and generates or stores a device identifier. — 5a5b41a4346f.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension reads supported broker cookies and session tokens and uses them for broker or Zing/Peepal requests. This establishes handling of authentication data, although the reviewed evidence does not prove that every page’s contents are uploaded.
The worker reads Lemonn authentication cookies and exposes a get_cookie message handler. — 4c1c5d0832e4.js:1
The Zerodha integration reads authentication-related cookies such as enctoken and user_id. — d645e90d9259.js:1
Session tokens and device identifiers are attached to extension-service requests. — 4c1c5d0832e4.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
The reviewed code shows trading UI interaction and order handling, but no clear recording or transmission of keystrokes, arbitrary form entries, clipboard contents, or screenshots.
No clipboard or screenshot permission is declared. — manifest.json:1-185
Keyboard listeners are used for UI shortcuts, not shown collecting or sending typed text. — bea1b10079b0.js:325
Can a website or remote server send commands that make the extension take actions?
Supported pages can send runtime messages that trigger extension actions such as fetching URLs, reading named cookies, refreshing signals, opening panels, reloading tabs, and showing notifications. The service-worker handlers do not show a general sender-origin allowlist.
chrome.runtime.onMessage handles http_fetch, get_cookie, refresh, panel, reload, notification, and sound actions. — 4c1c5d0832e4.js:1
A page/content-script bridge forwards window messages into extension messaging and storage operations. — a7221e89996a.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The reviewed code changes trading-page behavior and blocks a Delta feature request, but it does not establish modification of links, referral codes, advertisements, shopping carts, or search results. Trading actions are covered separately by question 24.
A request to Delta feature discovery is blocked. — dnr-delta-rules.json:1-10
The cited code invokes a trading adapter rather than changing links, ads, carts, or search results. — 0a37d116e4fb.js:208
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The extension modifies web-facing traffic on supported sites by intercepting page WebSocket construction and blocking a Delta feature request. It does not establish a browser-wide proxy or general download/header modification.
A declarative rule blocks requests to Delta feature discovery. — dnr-delta-rules.json:1-10
The CoinSwitch integration replaces or intercepts WebSocket construction on matching pages. — 043bd9ae4614.js:1-3
The extension has declarative network request permission and broad supported-site host access. — manifest.json:permissions and host_permissions
Can it communicate with software on the computer or services running on localhost?
The extension communicates with localhost services used as broker or exchange integrations, including localhost ports 3000 and 4000. This is browser-network communication with local web services, not evidence of native messaging or arbitrary installed-software control.
Localhost:3000 and localhost:4000 appear in broker tab matching and CoinSwitch URL handling. — 4c1c5d0832e4.js:1
The WebSocket integration explicitly recognizes localhost:4000. — 043bd9ae4614.js:1
The manifest includes matching local-development contexts in runtime configuration or code paths. — manifest.json:host_permissions and content_scripts
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The extension decodes or decompresses some stored and network data, but the reviewed reachable paths do not establish that decoded data is executed as JavaScript or injected as code. Bundled scripts are loaded as extension files, not downloaded code.
The codec implements encoded storage handling and decompression. — c5d3499c6098.js:1
The module decodes returned request data. — c8b44dc351cb.js:1-3
The service worker imports local bundled files through importScripts; no remote script execution is shown. — 4c1c5d0832e4.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Matched pages receive content scripts and some page bridges forward messages to privileged extension code. However, the evidence does not prove that arbitrary ordinary websites can use the bridge, and the exposed audio/icon resources do not themselves grant privileged API access.
Only listed broker, exchange, and related origins receive content scripts, including MAIN-world scripts. — manifest.json:content_scripts entries
A bridge forwards window messages to extension storage/runtime operations. — a7221e89996a.js:1
Privileged handlers include cookie, fetch, notification, and panel operations, but sender validation is not clearly shown. — 4c1c5d0832e4.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Several behaviors activate only for selected broker sites, login states, active tabs, stored settings, panel conditions, and time windows. Remote broker-status flags can also change which broker integrations remain enabled and cause affected tabs to reload.
Broker status is fetched remotely, stored, compared, and used to reload matching broker tabs. — 4c1c5d0832e4.js:1
Automatic sidebar arming depends on broker-tab state, fresh-tab tracking, and the daily 09:15 IST condition. — 4c1c5d0832e4.js:1
Scripts are restricted to selected origins, frames, and execution worlds. — manifest.json:content_scripts entries
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
The code contains polling, WebSocket connections, diagnostics, and trading-data processing, but no cryptocurrency-mining loop or comparable covert resource-intensive computation was identified.
Periodic alarms and socket watchdogs are used for signal synchronization and health checks. — 4c1c5d0832e4.js:1
The declared offscreen use is audio playback, not mining. — manifest.json:1-185
Does it change form fields or where a form sends its information?
The extension passes trading parameters such as side, quantity, and TP/SL values to broker-page adapters and can submit or exit positions. This changes trading actions rather than merely changing an HTML form destination.
The trading widget constructs trade parameters and calls the page’s trade adapter. — 0a37d116e4fb.js:208
The trading path passes TP/SL, side, shares, and order details. — 1c2d88f0dc7a.js:1
The active-signal path calls the broker’s exit-position adapter. — 7301998978ad.js:1