Is 7TV Nightly safe?
We analyzed 7TV Nightly version 3.1.25.1000's actual code and gave it a 74/100 trust score. This is a mostly purpose-aligned streaming enhancement with…
Bottom line
This is a mostly purpose-aligned streaming enhancement with moderate access and some design uncertainty, but no established abuse.
What it can access
It can modify Twitch pages and optionally work with YouTube, Kick, and 7TV sites for streaming features. [Q2] It also requests optional browser-extension management access, which is unusually powerful for an emote and viewing tool. [Q5]
Security weaknesses
Optional management access could affect other installed extensions if misused. [Q9] Generated code also leaves local-software communication and a worker-loading path incompletely verified, creating uncertainty about possible reachable actions. [Q19] [Q20]
Signs of misuse
The extension sends feature-related information to its own services and first-party platform services, while recorded audio is sent to a recognition service only after that feature is invoked. [Q6] Authentication values are sent to the corresponding first-party services, with no established transfer
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests access to Twitch pages, optional access to YouTube, Kick, and 7TV sites, browser-extension management, stored settings, temporary active-page access, and page modification. This broadly fits its stated streaming, emote, and performance features, but management access is more powerful than those features ordinarily require.
The manifest declares scripting, storage, activeTab, optional management, Twitch page access, and optional YouTube, Kick, and 7TV site access. — manifest.json:1
The content script runs on Twitch pages, while additional site access is optional. — manifest.json:1
The extension can process text entered into Twitch chat. — assets/seventv.ChatInputModule.3.1.25.10002.js:1
A user-invoked song-recognition feature can send recorded audio to AudD. — assets/seventv.CommandModule.3.1.25.1000.js:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*.twitch.tv/*, *://*.youtube.com/*, *://*.kick.com/*, *://*.7tv.app/*, *://*.7tv.io/* — manifest.json:1
Content scripts run directly on: *://*.twitch.tv/* — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
activeTab grants temporary access to the current page after a user action. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
On supported Twitch pages, the injected application can read and modify chat text that you type, so it can see messages entered into Twitch chat. There is no established evidence that it captures passwords, payment details, or unrelated form fields.
The content script injects the extension's page integration into Twitch pages. — content.js:1
The chat-input module accesses the editor, selection, text, and message-editing operations. — assets/seventv.ChatInputModule.3.1.25.10002.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No code evidence was found that reads browser history, bookmarks, downloads, or browser cookies through privileged APIs. Kick page JavaScript does read Kick cookies, but that is site-page access rather than browser-wide cookie access.
The declared permissions are scripting, storage, and activeTab, with optional management; history, bookmarks, downloads, and cookies are absent. — manifest.json:8-9
The code reads document.cookie on Kick and sends selected Kick tokens to kick.com/api/v1/user. — assets/seventv.KickSite.3.1.25.1000.js:1
The background code uses extension storage and IndexedDB-style data, not history, bookmarks, downloads, or cookies APIs. — background.js:1-7
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It requests access outside ordinary web pages: management.
The manifest requests: management — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends network requests to 7TV, Twitch, Kick, and related service endpoints for normal features such as configuration, emotes, account state, and events. A user-invoked song-recognition command also sends recorded audio to AudD.
Fetches extension configuration from 7tv.io. — assets/seventv.Compat.3.1.25.1000.js:1
The song-recognition command sends recorded stream audio to api.audd.io. — assets/seventv.CommandModule.3.1.25.1000.js:1
Uses Kick session-derived values for Kick's own user endpoint. — assets/seventv.KickSite.3.1.25.1000.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The extension dynamically imports JavaScript that is already packaged in the extension. It fetches remote configuration and event data, but the inspected behavior does not establish that a server supplies JavaScript or executes arbitrary downloaded code.
Loads packaged extension modules through dynamic imports. — site.js:1-7
Fetches remote compatibility/configuration data rather than demonstrated executable code. — assets/seventv.Compat.3.1.25.1000.js:1
Injects the packaged site.js and worker.js resources. — content.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The service worker and page integration can perform actions without a new visible user request, including update checks, extension reloads, settings synchronization, and page injection. Some higher-impact chat commands require the user to invoke the relevant feature first.
The service worker handles tab/update activity, broadcasts update state, and reloads or synchronizes the extension. — background.js:1-7
The content script injects the site integration automatically on matching Twitch pages. — content.js:1
The nuke feature can continue issuing scheduled chat actions after it has been invoked. — assets/seventv.CommandModule.3.1.25.1000.js:1-3
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It can change browser settings or manage installed extensions through: management.
The manifest requests setting-related permissions: management — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because the extension is largely bundled into generated, minified one-line files and loaded through additional modules. This reduces auditability but is not itself evidence of malicious behavior.
The content loader is compressed into a single line. — content.js:1
The application is assembled through dynamic module loading. — site.js:1-7
The service worker is a large generated bundle. — background.js:1-7
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No direct use of eval(), new Function(), or string-based timers was found in the inspected extension code. Ordinary callback-based timers are present and do not convert text into code.
The timer uses setTimeout with a callback function. — content.js:1
Update and tab-sync timers use callback functions, not code strings. — background.js:1,7
The inspected timer usage passes callbacks such as setTimeout(()=>le(!0),0). — assets/seventv.ChatInputModule.3.1.25.10002.js:1
Does it track the websites, pages, searches, or links you visit?
It observes pages and chat activity to provide Twitch/Kick features, and it maintains chat history for commands such as nuke. I found no clear evidence that it sends a browsing-history or link-visit log to an analytics service, but the generated application is not fully traceable.
The nuke feature stores recent chat messages and processes future messages for matching patterns. — assets/seventv.CommandModule.3.1.25.1000.js:1-3
The chat module reads active chatters, emotes, and typed chat-editor content. — assets/seventv.ChatInputModule.3.1.25.10002.js:1
The application is injected into matching Twitch pages and interacts with their DOM. — content.js:1
The worker maintains a WebSocket connection to 7TV events, but the supplied generated code leaves the exact event payload coverage uncertain. — worker.js:7
Does it create a persistent ID or browser fingerprint to recognize you?
No browser fingerprinting or persistent tracking ID was found. The code does create random identifiers for application data and event sessions, but the inspected code does not show them being used to recognize or track you.
Uses crypto.getRandomValues for UUID generation in bundled application code. — assets/seventv.ChatMessage.3.1.25.1000.js:1
The event connection has a sessionID field, but no evidence here ties it to user tracking. — worker.js:7
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension sends authentication-related values to the first-party services that use them: Kick session-derived tokens go to Kick, and the extension's 7TV token goes to 7TV. The inspected code does not establish that page contents or credentials are sent to an unrelated collector.
Reads Kick cookie values and sends session-derived authentication headers to kick.com/api/v1/user. — assets/seventv.KickSite.3.1.25.1000.js:1
Sends the extension's 7TV authorization token to 7tv.io/v3/gql. — assets/seventv.site.app.3.1.25.1000.js:33
Does it record typing, form entries, clipboard contents, or screenshots?
No code was found that records typing, form contents, clipboard contents, or screenshots. Clipboard writes are used only for explicit copy actions, such as copying an emote link or chat text.
Writes an emote URL to the clipboard after a user action. — assets/seventv.CommandModule.3.1.25.1000.js:1
Writes displayed chat-message text to the clipboard after a user action. — assets/seventv.UserTag.3.1.25.1000.js:513
Can a website or remote server send commands that make the extension take actions?
A webpage can send narrowly defined messages through the injected integration, including update checks and permission-request setup, but the permission path still requires a matching page control and user switch. The available bundled event code does not fully establish whether remote events can trigger additional extension actions.
Receives BroadcastChannel messages and forwards permission requests or update checks. — content.js:1
Handles runtime messages for permission requests and update checks. — background.js:1-7
Contains 7TV event/WebSocket transport whose complete command handling is not established here. — worker.js:7
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence was found of affiliate-link rewriting, advertisement injection, shopping-cart manipulation, or search-result changes. The extension primarily injects its interface and emote-related features on supported sites.
Content-script and host coverage is centered on Twitch, with optional site permissions for YouTube, Kick, and 7TV domains. — manifest.json:1
Injects the extension site script, stylesheet, and bundled emoji resources. — content.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No webRequest, proxy, download interception, or request-header modification was found. The code does make ordinary fetch and WebSocket requests for extension functionality.
No webRequest, proxy, downloads, or declarative network-blocking permissions are declared. — manifest.json:1
Generic API requests set application headers and referrer policy, but do not demonstrate traffic interception. — worker.js:7
Can it communicate with software on the computer or services running on localhost?
The extension contains code that can contact a worker address stored in local storage or otherwise supplied by the application, including localhost-style addresses. The inspected evidence does not prove that a local service is contacted during ordinary use or show what data it receives.
Recognizes localhost/127.0.0.1 contexts and attempts to use an existing worker address or fetch worker data from a stored address. — assets/seventv.GearsIcon.3.1.25.1000.js:5,11
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The extension loads packaged modules and may load worker data through a blob-based path, but the available generated code does not conclusively show that hidden or remotely fetched data is decoded and executed. The exact worker-loading caller and input validation need further tracing.
Dynamically imports packaged extension modules. — site.js:1-7
Injects packaged site.js and worker.js into supported pages. — content.js:1
Contains worker-data fetching/loading logic involving a stored or configured address. — assets/seventv.GearsIcon.3.1.25.1000.js:11
Can ordinary websites access privileged extension features through messaging or exposed files?
Supported Twitch, YouTube, and Kick pages can fetch declared web-accessible resources, but that alone does not grant privileged extension APIs. The Twitch content script does accept page messages for limited operations, and the full permission-checking behavior should be traced before calling this an unrestricted privilege bridge.
Declares web-accessible resources for Twitch, YouTube, and Kick matches. — manifest.json:1
Forwards typed permission-request and update-check messages from the page integration to chrome.runtime. — content.js:1
Processes permission-request and update-check runtime messages. — background.js:1-7
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Some behavior is conditional on the website, optional permissions, configuration, and update state. In particular, compatibility checks use remote configuration and management access is requested only when the user opens that feature.
Fetches remote configuration from https://7tv.io/v3/config/extension-nightly and uses it for compatibility checks. — assets/seventv.Compat.3.1.25.1000.js:1
Requests the optional management permission before enumerating installed extensions. — assets/seventv.Compat.3.1.25.1000.js:1
Different host permissions and content-script behavior apply to Twitch versus optional YouTube and Kick support. — manifest.json:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining or other concealed high-cost computation was found. Timers and token-bucket logic appear related to chat commands and UI behavior.
Uses a token bucket and interval for the chat nuke command, not mining. — assets/seventv.CommandModule.3.1.25.1000.js:1-3
Contains IndexedDB and scheduling library code, with no demonstrated mining workload. — assets/seventv.GearsIcon.3.1.25.1000.js:11
Does it change form fields or where a form sends its information?
The extension clearly creates its own settings and input controls, but the inspected code does not establish that it modifies ordinary website form destinations or submitted fields. Generated UI code and platform integrations make complete exclusion difficult.
Creates extension input controls for chat interaction. — assets/seventv.ChatModule.3.1.25.10002.js:2
Creates settings-form input elements and handles their input events. — assets/seventv.GearsIcon.3.1.25.1000.js:11
The declared content-script scope is Twitch, with optional injection on YouTube and Kick; no form-specific permission or behavior is declared. — manifest.json:1