Is Repeek (formerly FACEIT Enhancer) safe?
We analyzed Repeek (formerly FACEIT Enhancer) version 5.6.11's actual code and gave it a 68/100 trust score. A FACEIT-focused extension with proportionate…
Bottom line
A FACEIT-focused extension with proportionate site access, but meaningful uncertainty from opaque code and remotely supplied settings.
What it can access
It can read and change FACEIT pages, inspect selected page-component data when asked by a FACEIT page, write to your clipboard, and communicate with FACEIT’s service. This is broadly related to its advertised FACEIT enhancements, but still gives it access to on-page information.
Signs of misuse
There is no established evidence of stolen sign-in data, typing capture, altered links or forms, hidden mining, or downloaded code execution. Remotely supplied settings and heavily compressed code leave important behavior insufficiently verifiable.
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and clipboard-writing access, can run on all FACEIT pages, and can communicate with FACEIT’s service. That access broadly fits an extension that adds FACEIT features, but page access can expose information displayed on those pages.
Declares permissions "storage" and "clipboardWrite"; host access for "https://api.faceit.com/*"; and content scripts on "https://www.faceit.com/*" at document_start and document_end. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: https://api.faceit.com/* — manifest.json:1
Content scripts run directly on: https://www.faceit.com/*, https://www.faceit.com/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The manifest shows code running on every FACEIT page, including in the page’s main world, but the available evidence does not establish whether it reads typed passwords, payment details, messages, or form fields.
Content scripts run on https://www.faceit.com/*; window/script.js runs in the page’s MAIN world, while faceit/index.js runs as a content script. — manifest.json:1-1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence was found in the manifest or package for this capability.
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It requests access outside ordinary web pages: clipboardWrite.
The manifest requests: clipboardWrite — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The manifest permits requests to the FACEIT API, but the available evidence does not show which requests are made, what data they contain, or whether other external services are contacted.
The extension has host permission for https://api.faceit.com/*, indicating that API communication may be possible. — manifest.json:1-1
Does it download or run code, settings, or instructions supplied by a remote server?
The available evidence does not establish whether remote responses are downloaded or executed as code or instructions. The extension has substantial JavaScript files and an API permission, but the relevant source behavior was not inspected.
The manifest grants access to https://api.faceit.com/*, but this alone does not show that returned data is treated as executable code or settings. — manifest.json:1-1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The manifest shows scripts that run automatically on every matching FACEIT page, but it does not reveal which actions they perform. Source tracing is needed to determine whether they open pages, redirect searches, download files, or send requests without a clear user request.
Content scripts run automatically at document_start or document_end on https://www.faceit.com/*. — manifest.json:1-1
The extension has host permission for https://api.faceit.com/*, allowing requests there, but the manifest does not show when or why such requests occur. — manifest.json:1-1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Some packaged behavior is difficult to inspect automatically.
This file is heavily minified into an unusually long line. — background/index.js:1
This file is heavily minified into an unusually long line. — faceit/index.js:63
This file is heavily minified into an unusually long line. — options/index.js:8
This file is heavily minified into an unusually long line. — popup/index.js:119
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No direct indicators were found in readable source files or the manifest.
Does it track the websites, pages, searches, or links you visit?
The reviewed source provides no evidence that the extension records or sends the websites, pages, searches, or links you visit. The flagged matches are unrelated UI/library uses of “tracking,” not browsing-history collection.
The extension is restricted to FACEIT pages and the FACEIT API; it has no browsing-history, tabs, or webRequest permission. — manifest.json:1-31
The cited “tracking” matches are CSS text and React input-value tracking code, not visitor or browsing telemetry. — faceit/index.js:1,72-74
Does it create a persistent ID or browser fingerprint to recognize you?
No direct indicators were found in readable source files or the manifest.
Does it send cookies, session details, authentication data, or page contents elsewhere?
The available source is heavily bundled and the relevant network/data-flow code could not be fully traced. No reliable evidence establishes whether cookies, authentication data, or page contents are sent to an outside service.
The extension is allowed to run on faceit.com and access api.faceit.com, but the manifest alone does not show what data is transmitted. — manifest.json:1-46
The bundled background code contains generic fetch/network-library code, but its relevant callers and transmitted payloads could not be isolated reliably from the available excerpt. — background/index.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No reliable evidence was found that the extension records typing, form entries, clipboard contents, or screenshots. The cited matches are bundled libraries or ordinary UI event/form-handling code, not demonstrated collection or transmission of this data.
The cited change-event match is inside a large bundled/minified file and does not, by itself, demonstrate recording user input or sending it anywhere. — background/index.js:1
The cited FormData match is insufficient to show collection or exfiltration; no readable data flow was established from form fields to storage or an external destination. — faceit/index.js:72
The cited keyboard/change handlers are popup UI behavior and do not establish keystroke logging, clipboard capture, or screenshot recording. — popup/index.js:8-9, 53-57
Can a website or remote server send commands that make the extension take actions?
The Faceit page can send specially formatted window messages that make the extension’s main-world script perform a data lookup. The demonstrated action is limited to reading selected React/Fiber properties from page elements and returning them to the page; no remote-server command channel is shown.
A window message listener accepts messages originating from the same page when data.source is "repeek", data.id has the expected type, and data.request exists. It dispatches by data.type, invokes the matching handler, and posts the response — window/script.js:1
The registered getFiberNodeChildrenProps handler locates a page element by the supplied elementId, reads React memoizedProps children, extracts requested child properties, and returns the results through window.postMessage — window/script.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
The reviewed source is a bundled, minified file and the cited `.href` match is not sufficient to show link, referral, advertising, cart, or search-result modification. No representative behavior demonstrating those changes was established.
The cited `.href` occurrence is inside bundled library/runtime code; it does not by itself show modification of a page link, referral code, advertisement, cart, or search result. — background/index.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No direct indicators were found in readable source files or the manifest.
Can it communicate with software on the computer or services running on localhost?
No direct indicators were found in readable source files or the manifest.
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The reviewed decoding code handles ordinary Base64, Base64URL, and JWT validation or byte conversion. No reviewed evidence shows decoded data being executed as code or injected into a page.
The atob-based helper converts Base64 input into a Uint8Array; its paired helper converts bytes back to Base64. — faceit/index.js:1
The atob usage parses a JWT-like value with JSON.parse for validation, rather than executing the decoded result. — faceit/index.js:4
The corresponding helper likewise performs Base64-to-byte conversion. — popup/index.js:57
The other atob usage is in Base64 format validation; no execution or injection sink is shown. — popup/index.js:60
Can ordinary websites access privileged extension features through messaging or exposed files?
A page-level script creates an unrestricted window message bridge. Any script on an affected Faceit page can send correctly shaped messages and invoke the exposed React-fiber inspection function, although the demonstrated action is limited to reading selected page DOM/component data.
The main-world script accepts messages when source is window, data.source is "repeek", data.id has the expected type, and a request exists; it then dispatches by the caller-controlled data.type and posts the response back without origin or, — window/script.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
The extension contains remote-configuration handling and time-based code, so some behavior can vary by remotely supplied settings or date. The available source excerpts are bundled/minified and do not establish which specific suspicious action is gated or whether individual users are targeted.
The background bundle defines API/CDN clients for extension-api.repeek.gg and extension-cdn.repeek.gg and copies `extension.remoteConfig` into `extension.config`, demonstrating remotely supplied configuration. — background/index.js:1
The content-script bundle contains the same `extension.remoteConfig` to `extension.config` migration and references experiment/variant-related code, indicating conditional configuration or rollout logic. — faceit/index.js:1
The bundle contains a `Date.now() < ...` comparison, demonstrating date/time-dependent execution, but the excerpt does not identify the gated action. — faceit/index.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No direct indicators were found in readable source files or the manifest.
Does it change form fields or where a form sends its information?
The available source excerpt does not show the extension changing form fields, form actions, or submission destinations. However, the relevant application code was not available for complete tracing, so this cannot be treated as definitive evidence of no change.
The visible main-world script only handles window messages and reads React component properties; it contains no form-field assignment, form action change, or form submission code. — window/script.js:1