Is SherpaDesk | Helpdesk Customer Support Ext safe?
We analyzed SherpaDesk | Helpdesk Customer Support Ext version 1.0.17's actual code and gave it a 48/100 trust score. The extension is purpose-aligned but…
Bottom line
The extension is purpose-aligned but has a serious insecure remote interface and weak message validation.
What it can access
Access is limited to SherpaDesk services and needed for ticket work, but it stores reusable service credentials. [Q1][Q4]
Security weaknesses
The main interface is loaded over unencrypted HTTP, and messages can change credentials without verifying their sender. [Q7][Q16]
Signs of misuse
There is no evidence of unrelated tracking, browsing surveillance, or confirmed misuse of collected information. [Q12][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage, alarms, and HTTPS access across the SherpaDesk services and all SherpaDesk subdomains. It has no arbitrary-site page access, tabs, history, cookies, or scripting permission.
Declares storage, alarms, api.sherpadesk.com, and all HTTPS SherpaDesk subdomains. — manifest.json:permissions and host_permissions
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
No content_scripts, activeTab, or scripting permission is declared. — manifest.json:top-level fields
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension code does not read website form fields, but the remote SherpaDesk application filling the popup can collect login, ticket, and customer-support input within its own page. Loading that application over HTTP risks exposing such data in transit if the frame is allowed.
Embeds http://m.sherpadesk.com as the complete popup interface. — popup.html:27-29
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores the 32-character SherpaDesk services key, organization key, and installation key in chrome.storage.local. It also uses popup localStorage for a reload flag but does not access cookies, history, or bookmarks.
Stores or removes sd_api_key, sd_org_key, and sd_inst_key and manages localStorage reload state. — popup.js:20-33
Reads the three credential values from local extension storage. — js/background.js:16-26
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of these permissions or hosts. — manifest.json:permissions and host_permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The remote SherpaDesk iframe necessarily communicates account/ticket interactions to SherpaDesk. The background also intends to send organization, installation, and services-key credentials to SherpaDesk in a Basic Authorization header for queue counts, although its current URL construction is broken.
Loads the remote SherpaDesk application over HTTP. — popup.html:27-29
Builds Basic authentication from org-inst:apiKey and prepares a credentialed fetch. — js/background.js:30-45
Attempts the queue-count request and removes the API key on failure. — js/background.js:48-64
Does it download or run code, settings, or instructions supplied by a remote server?
The entire visible helpdesk application is remotely supplied by m.sherpadesk.com over unencrypted HTTP. That site or an on-path attacker can change the displayed UI and messages without an extension update, though the iframe remains a separate origin from the extension parent.
Uses an HTTP remote iframe as the full popup body. — popup.html:27-29
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On installation it creates a repeating two-minute alarm, and each alarm automatically attempts to fetch queue counts using stored credentials. The current call appears to fail because config.url is never assigned, after which it deletes the stored services key.
Creates and handles the refreshData alarm every two minutes. — js/background.js:3-14
Passes a credential object without url, while getSherpaDesk reads config.url before fetch. — js/background.js:16-25, 30-49
Removes sd_api_key on request failure. — js/background.js:60-63
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains no override, proxy, management, downloads, or settings permission. — manifest.json:top-level fields
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable complete popup integration. — popup.js:1-38
Readable complete background logic. — js/background.js:1-73
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses setTimeout with a function callback. — popup.js:11
Contains no dynamic-code sink. — js/background.js:entire file
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs, history, or content-script access is declared. — manifest.json:permissions and top-level fields
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Accepts service-supplied credentials but does not create a tracking identifier. — popup.js:13-29
Does it send cookies, session details, authentication data, or page contents elsewhere?
It stores a reusable SherpaDesk services key plus organization and installation identifiers and intends to send them as Basic authentication. The popup accepts replacement credentials from postMessage without validating the sender origin or source.
Parses t/o/i parameters from any message event and stores them without checking e.origin or e.source. — popup.js:13-29
Reads the credentials and Base64-encodes org-inst:apiKey for the Authorization header. — js/background.js:19-24, 30-44
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No capture or clipboard capability is declared. — manifest.json:permissions
Can a website or remote server send commands that make the extension take actions?
Remote iframe content can send arbitrary window messages to the popup. Because the handler verifies neither origin nor source, it can set any 32-character services key with arbitrary organization/installation values, clear credentials with logout, and force a popup reload.
Global onmessage handler trusts e.data, persists parsed credential parameters, honors logout, and reloads without sender validation. — popup.js:13-37
The message-producing remote frame is loaded over HTTP. — popup.html:27-29
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Local wrapper contains only styling, popup.js, and the SherpaDesk iframe. — popup.html:1-32
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, or downloads permission is declared. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or local/private host is declared. — manifest.json:permissions and host_permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Embeds active remote HTTP content. — popup.html:27-29
Acts on remote message data without authenticating its source. — popup.js:13-37
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Allows SherpaDesk origins to message the extension and exposes icon-48.png to all URLs. — manifest.json:externally_connectable and web_accessible_resources
External listener answers only the exact is_installed message. — js/background.js:67-73
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Runs based on installation, the two-minute alarm, and credential presence. — js/background.js:3-25
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Schedules the repeating alarm, builds fetch from an unset config.url, and removes the key on error. — js/background.js:3-14, 30-64
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content script, activeTab, or scripting capability is declared. — manifest.json:top-level fields