Is Konvo: DMs Only safe?
We analyzed Konvo: DMs Only version 0.1.7's actual code and gave it a 84/100 trust score. Konvo is narrowly focused on redirecting Instagram pages to its…
Bottom line
Konvo is narrowly focused on redirecting Instagram pages to its own service, with no evidence of data theft or dangerous remote control.
What it can access
The extension can control top-level navigation on Instagram and automatically send matching pages to Konvo [Q2][Q8]. This is reasonably aligned with blocking Instagram, but it can interrupt visits without a separate confirmation [Q8].
Security weaknesses
The main weakness is that matching Instagram pages are redirected automatically, which could unexpectedly interrupt navigation [Q8]. The fixed rule does not show broader control over headers, downloads, proxy settings, or other browser settings [Q18][Q9].
Signs of misuse
There is no evidence that the extension collects passwords, messages, cookies, browsing history, or form data [Q3][Q4][Q14][Q15]. Its only outside communication is the intended redirect to Konvo with a fixed source marker, and no misuse is established [Q6][Q12].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension can control top-level navigation on Instagram and redirect those pages to Konvo; this is consistent with its stated purpose, though it can interrupt navigation automatically.
The manifest requests declarativeNetRequest access and access to *://*.instagram.com/*. — manifest.json:1
A fixed rule redirects matching top-level Instagram pages to https://konvoinstall.com/blocked?utm_source=extension, while selected authentication-related paths are allowed. — rules.json:133-147
No content scripts, cookies, history, downloads, storage, or device-access permissions are declared. — manifest.json:8-17
Which websites can it run on, and can it read or change what appears on those pages?
It can communicate with the listed websites, but the manifest does not declare automatic page scripts.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: *://*.instagram.com/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No content scripts or page-reading logic are included, so the code provides no evidence that it sees passwords, payment details, messages, or form entries.
Only declarativeNetRequest is requested; no content-script or scripting permission is declared. — manifest.json:8-17
Rules only allow or redirect main-frame requests and do not inspect form or page data. — rules.json:1-147
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
There is no evidence that it accesses cookies, signed-in sessions, browsing history, bookmarks, or downloads.
No cookies, history, bookmarks, downloads, or related permissions are declared. — manifest.json:8-17
The rules contain only main-frame network allow and redirect actions. — rules.json:1-147
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
When an Instagram page is redirected, the browser is sent to konvoinstall.com with a fixed utm_source=extension parameter. The source does not show other information being collected or transmitted by the extension.
The redirect destination is https://konvoinstall.com/blocked?utm_source=extension. — rules.json:133-139
The extension contains no background or content-script file declaration for additional data transmission. — manifest.json:8-17
Does it download or run code, settings, or instructions supplied by a remote server?
No remote code, settings, or instructions are downloaded or executed by the extension. The update URL is the browser's normal extension-update mechanism, not runtime code loading shown in the package.
No externally hosted scripts, service worker, or dynamic code-loading mechanism is declared. — manifest.json:1-17
The bundled rules are static and contain no remote configuration source. — rules.json:1-147
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
When a top-level Instagram URL is requested, the extension automatically redirects it to Konvo without requiring a separate confirmation for the redirect. Authentication-related paths are exempt, and the code shows no separate behavior for downloads or arbitrary requests.
Rule 20 automatically redirects matching http(s)://instagram.com or www.instagram.com main-frame navigations to https://konvoinstall.com/blocked?utm_source=extension. — rules.json:133-147
Higher-priority allow rules exempt selected main-frame paths including accounts, challenge, two_factor, auth_platform, oauth, api, graphql, session, and login. — rules.json:1-131
The enabled declarativeNetRequest rules are active for Instagram host patterns; no content scripts, popup, service worker, or other runtime code is declared. — manifest.json:1-24
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The inspected logic is short, readable JSON with no obfuscation or hidden third-party runtime code. The package contains only the manifest, rules, icons, and verification metadata.
The manifest declares no bundled executable scripts. — manifest.json:1-23
The complete rule set is plainly readable and static. — rules.json:1-147
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No eval(), new Function(), or string-based timer use is present; there is no executable JavaScript in the package inventory.
No JavaScript files or executable extension contexts are declared. — manifest.json:1-23
The only behavioral file contains declarative JSON rules. — rules.json:1-147
Does it track the websites, pages, searches, or links you visit?
It does not record or report visited websites, pages, searches, or links. It only matches Instagram main-frame navigation to enforce the redirect rule.
No history, tabs, webNavigation, or content-script permissions are declared. — manifest.json:8-17
Matching is limited to Instagram main-frame URLs for request handling, with no logging or reporting action. — rules.json:141-146
Does it create a persistent ID or browser fingerprint to recognize you?
No persistent identifier or browser-fingerprinting code is present. The package contains only a manifest and static network rules.
Declares only declarativeNetRequest and Instagram host access; no storage, scripting, or identity-related functionality. — manifest.json:4-23
Contains only URL allow and redirect rules, with no identifier or fingerprint logic. — rules.json:1-147
Does it send cookies, session details, authentication data, or page contents elsewhere?
No code sends cookies, authentication data, session details, or page contents elsewhere. The rules only control top-level Instagram navigation.
No network, cookies, webRequest, scripting, or messaging permissions are declared. — manifest.json:8-17
Rules do not read or transmit request data; they allow selected Instagram pages and redirect other main-frame requests. — rules.json:1-147
Does it record typing, form entries, clipboard contents, or screenshots?
There is no evidence of typing, form, clipboard, or screenshot recording. No content scripts or capture permissions are included.
No scripting, clipboard, tabs, or capture permissions are declared. — manifest.json:8-17
Only main-frame URL filtering and redirection are defined. — rules.json:1-147
Can a website or remote server send commands that make the extension take actions?
No website or remote server can send commands to the extension based on the available code. There are no message listeners, background scripts, or remotely configurable actions.
No service worker, externally connectable setting, or messaging-related permission is declared. — manifest.json:4-18
The only action is a fixed redirect to konvoinstall.com. — rules.json:133-147
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It does not alter links, ads, shopping carts, referral codes, or search results. It does append a fixed tracking-style query parameter to its own redirect destination.
Redirects blocked Instagram top-level pages to https://konvoinstall.com/blocked?utm_source=extension; this is not a link, ad, cart, or search-result modification. — rules.json:133-139
The redirect applies only to Instagram main-frame navigation. — rules.json:141-147
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It redirects certain web traffic: top-level Instagram pages are sent to a fixed Konvo URL. It does not modify headers, downloads, or proxy settings.
Rule 20 redirects matching http/https Instagram main-frame URLs to https://konvoinstall.com/blocked?utm_source=extension. — rules.json:133-147
Only declarativeNetRequest is declared; no proxy, webRequest, downloads, or header-modification permission appears. — manifest.json:8-17
Can it communicate with software on the computer or services running on localhost?
There is no evidence of communication with desktop software or localhost services. No native messaging, fetch code, or localhost permission is present.
No nativeMessaging permission, service worker, or localhost host permission is declared. — manifest.json:8-17
Rules reference Instagram and konvoinstall.com only; no localhost or local-network endpoint appears. — rules.json:1-147
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No hidden data is decoded, decrypted, unpacked, executed, or injected. The package has no executable JavaScript or content scripts.
No scripts, service worker, or code-injection capability is declared. — manifest.json:4-23
The file is plain declarative JSON containing fixed network rules. — rules.json:1-147
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary websites are not given messaging access to privileged extension features. No exposed resources or externally connectable origins are declared.
No externally_connectable, web_accessible_resources, or messaging implementation is present. — manifest.json:4-18
The extension exposes only fixed declarative navigation behavior. — rules.json:1-147
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
There is no remote setting, user targeting, date check, or conditional activation logic. The rules use fixed Instagram URL patterns and a fixed redirect.
All conditions are static URL filters or regexes; no dates, users, remote configuration, or runtime checks appear. — rules.json:1-147
No service worker or update-controlled runtime logic is declared. — manifest.json:4-18
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No hidden resource-intensive work or cryptocurrency-mining behavior is present. The package contains no executable workload code.
Declares no scripts, workers, or execution-related capabilities. — manifest.json:4-23
Contains only lightweight navigation rules. — rules.json:1-147
Does it change form fields or where a form sends its information?
It does not change form fields or form destinations. It only redirects top-level Instagram navigation, while allowing selected login and authentication paths.
Authentication-related paths such as /login, /oauth, /session, and /two_factor are allowed as main-frame navigations; no form manipulation is defined. — rules.json:1-131
The blocking rule redirects only matching Instagram main-frame URLs, not form submissions or fields. — rules.json:133-147