Is LeadCRM: CRM Sync & Lead Finder (Email/Phone) safe?
We analyzed LeadCRM: CRM Sync & Lead Finder (Email/Phone) version 3.7.5's actual code and gave it a 38/100 trust score. This is a purpose-aligned CRM…
Bottom line
This is a purpose-aligned CRM extension with high data access and concerning automatic collection of private LinkedIn conversations.
What it can access
It can read LinkedIn pages, private conversations, CRM records, and authentication-related data, then send that information to LeadCRM and connected services.[Q3][Q6][Q14][Q15]
Security weaknesses
Background synchronization can send private conversations without a clear immediate request, while LeadCRM pages can set account state and trigger extension actions.[Q8][Q16][Q21]
Signs of misuse
The package shows automatic collection and transfer of private messages, profile data, and CRM information beyond the narrowly stated lead-finding purpose.[Q6][Q8][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has tabs, storage, cookies, and alarms; host access to LinkedIn, LeadCRM, Google authentication/services, and optional HubSpot hosts; and an all-frame page access on every www.linkedin.com page. LeadCRM subdomains can connect externally.
Declares broad LinkedIn/LeadCRM host access, cookies, tabs, alarms, all-frame LinkedIn injection, optional HubSpot access, and externally connectable LeadCRM pages. — manifest.json:9-64
Which websites can it run on, and can it read or change what appears on those pages?
It injects a full CRM/enrichment interface into LinkedIn, adds controls and modals, reads page fields, and can populate or act on CRM/profile workflows. It does not redirect HTML form actions to unrelated sites, but it materially edits LinkedIn's UI and can trigger user-selected exports and CRM changes.
Bundled React application mounts LeadCRM roots, sidebars, export controls, enrichment panels, and workflow dialogs throughout LinkedIn. — scripts/content.js:2
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It reads LinkedIn profiles, companies, searches, current-user identity, public and Sales Navigator IDs, message threads, and page context. It also displays CRM contacts, fields, notes, tasks, deals, teammates, enrichment results, and activity while the user browses LinkedIn.
Extracts profile/company/search data and exposes numerous LeadCRM/CRM read workflows. — scripts/content.js:2
Reads current LinkedIn identity and private inbox/Sales Navigator APIs. — service-worker.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores LeadCRM access and secure tokens, user information, CRM identity, LinkedIn entity/name, sync settings/timestamps, Sales Navigator enablement, profile caches, UI state, and other account data in chrome.storage.local. The Sales Navigator mapping cache can retain up to 500 profile/thread mappings.
Persists authentication, user, sync, identity, alarm, failure, and profile-cache state. — service-worker.js:1
Logout removes a broad set of locally stored token, CRM, user, language, mapping, and UI keys. — tabs/popup.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It processes LeadCRM login/registration credentials, private LinkedIn and Sales Navigator message bodies, contact/profile data, found email/phone numbers, CRM notes/tasks/deals/fields, and optional HubSpot session context. These are expected product inputs but highly sensitive.
Collect and submit account email, password, name, phone, and company. — tabs/login.js, tabs/signup.js:1
Transforms private messages into content, sender, timestamp, and identity records for synchronization. — service-worker.js:1
Implements email/phone enrichment and CRM record workflows. — scripts/content.js:2
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends LeadCRM credentials and LinkedIn profile URL to dash.leadcrm.io; uploads private conversation messages with sender/profile/thread metadata; submits profiles for enrichment/export; and sends CRM notes, tasks, deals, fields, and edits through LeadCRM. Google/Microsoft OAuth and connected CRM providers receive the corresponding integration traffic.
Posts login/register data and person-conversions containing LinkedIn or Sales Navigator message content to dash.leadcrm.io. — service-worker.js:1
Calls LeadCRM endpoints for profiles, enrichment, contacts, companies, fields, notes, tasks, deals, and integrations. — scripts/content.js:2
Does it download or run code, settings, or instructions supplied by a remote server?
LeadCRM services responses determine CRM mappings, enrichment results, sync cutoffs, plan limits, UI records, AI text, and next actions. External LeadCRM pages can provision auth data.
Routes packaged application API calls to the fixed https://dash.leadcrm.io origin. — api.js:1
Uses backend sync-selection responses and accepts SET_AUTH_DATA from allowed LeadCRM pages. — service-worker.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
After LeadCRM login, randomized alarms repeatedly scan LinkedIn conversations and synchronize new messages. Sales Navigator sync is enabled when its auth context is present or a Sales Navigator page loads, and retries every few minutes; normal uploads are skipped only when the sync_message setting is Manual.
initializeSync, linkedinSyncAlarm, salesNavSyncAlarm, handleConversationsGraphQL, and handleSalesNavSync schedule background synchronization at randomized three-to-ten-minute intervals. — service-worker.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Contains fixed API flows for add/update/delete/link CRM records and bulk profile export/enrichment. — scripts/content.js:2
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The 4.2 MB content application is minified into one line with bundled React and many dependencies, making independent review difficult. The service worker and UI bundles are also minified, although services and security-sensitive flows remain identifiable and there is no evidence of deliberate encrypted packing.
Lists a 4,221,722-byte one-line content bundle plus minified worker and popup/login/signup scripts. — inventory.json:complete file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Webpack runtime has one fixed new Function fallback for globalThis detection. — scripts/content.js:2
Extension-page CSP is script-src 'self'. — manifest.json:63-65
Does it track the websites, pages, searches, or links you visit?
It reads current LinkedIn URLs and listens for tab updates to detect profiles, searches, messaging, Sales Navigator, and navigation changes. It stores profile/thread identities and sync timestamps, but no general non-LinkedIn browsing history is collected.
tabs permission plus an all-frame LinkedIn content script provide tab and page URL context. — manifest.json:30-50
tabs.onUpdated detects Sales Navigator routes and message synchronization stores thread/profile mappings. — service-worker.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It persistently links the LeadCRM user/account token with LinkedIn entity IDs, profile URLs, names, message thread IDs, CRM identity, sync timestamps, and local profile caches. No separate advertising ID or unrelated cross-site tracking SDK was found.
Stores user_info, LinkedIn entity/name, LeadCRM tokens, sync timestamps, and up to 500 Sales Navigator identity mappings. — service-worker.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads LinkedIn JSESSIONID for CSRF authentication and li_ep_auth_context for Sales Navigator identity headers. It also stores LeadCRM bearer/secure tokens and, with optional permission, reads HubSpot's hubspotapi-csrf cookie.
getCSRFtoken/getcsrfValue read JSESSIONID; getSalesNavIdentity reads li_ep_auth_context; HubSpot upload reads hubspotapi-csrf. — service-worker.js:1
Declares cookies and the required/optional service hosts. — manifest.json:9-18, 30-35
Does it record typing, form entries, clipboard contents, or screenshots?
It reads private LinkedIn and Sales Navigator message bodies, sender identities, subjects, attachments metadata, timestamps, profile/contact data, found emails/phones, and connected CRM business records. Conversation content can be uploaded automatically to LeadCRM after login.
Fetches inbox threads and maps body/subject, sender, timestamps, identities, and attachment presence into person-conversions uploads. — service-worker.js:1
Implements profile/contact enrichment and CRM record display/editing. — scripts/content.js:2
Can a website or remote server send commands that make the extension take actions?
LeadCRM determines which contacts should sync, the last uploaded timestamp, CRM field mappings, enrichment providers/results, AI-generated text, plan behavior, and integration destinations. External LeadCRM pages can set extension auth state, but arbitrary non-LeadCRM services proxying is blocked by an exact dash.leadcrm.io origin check.
check-person-conversation responses select uploads; SET_AUTH_DATA provisions tokens; API_REQUEST validates exact dash.leadcrm.io origin. — service-worker.js:1
All packaged application API calls use the fixed LeadCRM base URL. — api.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Links and upgrade prompts relate to LeadCRM, its integrations, help, reviews, or plans. — scripts/content.js, tabs/popup.js:complete bundles
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No network interception permission is declared. — manifest.json:30-35
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares only HTTPS service hosts and no nativeMessaging permission. — manifest.json:9-35
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote data is handled by bundled React/API code; targeted sink tracing found no response-to-code path. — scripts/content.js:2
Can ordinary websites access privileged extension features through messaging or exposed files?
LeadCRM subdomains are externally connectable and can send SET_AUTH_DATA to store LeadCRM tokens/user state, cause LinkedIn tabs to reload, open an integration URL containing a secure token, and ping the extension. The browser manifest limits senders to LeadCRM subdomains; no general page-to-extension bridge was found on LinkedIn.
Allows external connections from https://*.leadcrm.io. — manifest.json:19-23
External listeners handle SET_AUTH_DATA, CRM_CONNECTED, and pingExtension. — service-worker.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Background sync branches on token, settings, timestamps, Sales Navigator identity, gaps, and failures. — service-worker.js:1
UI and actions vary by CRM, plan, page, permissions, and backend records. — scripts/content.js:2
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Schedules randomized recurring sync, paginates up to 10 inbox pages and 20 Sales Navigator pages, and spaces detail uploads. — service-worker.js:1
Supports bulk export of large LinkedIn/Sales Navigator search result sets. — scripts/content.js:2
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Install/auth listeners open login, LinkedIn, profile, and integration tabs and reload LinkedIn pages. — service-worker.js:1
User actions open OAuth, CRM, dashboard, pricing, and support destinations. — tabs/login.js, tabs/signup.js, tabs/popup.js:1