Is SynQ for Spotify, YouTube, Amazon Music, more safe?
We analyzed SynQ for Spotify, YouTube, Amazon Music, more version 4.0.8's actual code and gave it a 76/100 trust score. The extension is broadly capable…
Bottom line
The extension is broadly capable but its demonstrated activity is mostly limited to supported music services, with music metadata and usage telemetry sent to its services.
What it can access
It can read and change supported music-service pages, and it asks for optional access that could cover all websites plus tabs and notifications [Q2]. That is broader than the core feature needs, but the demonstrated data is music playback and track information rather than passwords or private files;
Signs of misuse
The extension sends music metadata and usage telemetry to SynQ and Google Analytics, including a session identifier [Q6] [Q12] [Q13]. This raises a privacy concern, but the review found no established password, cookie, form-data, browsing-history, or remote-code collection [Q14] [Q7].
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests storage and page-control capabilities, with optional broad website access, mainly to provide a music player and sharing across four named music services.
The extension requests storage and scripting, and optionally tabs, notifications, and broad website access patterns including https://*/*, *://*/*, and <all_urls>. — manifest.json:1
Automatic page access is limited to Apple Music, Spotify, YouTube Music, Amazon Music, and SynQ redirect pages. — manifest.json:1
The reviewed behavior reads music playback state, queues, controls, and track metadata. — common.3475fd4e.js:reachable content-script paths
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: https://*/*, *://*/*, <all_urls> — manifest.json:1
Content scripts run directly on: *://music.apple.com/*, *://open.spotify.com/*, *://music.youtube.com/*, *://music.amazon.com/*, https://*.synqapp.io/redirect*, *://music.apple.com/*, *://open.spotify.com/*, *://music.youtube.com/* — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The reviewed runtime reads music-service playback and track metadata, not passwords, payment fields, messages, or ordinary form entries. No supported content-script path copies such sensitive values to an extension sink or external destination.
Automatic page access is limited to four music-service origins and SynQ redirect pages. — manifest.json:content_scripts
Mapped behavior concerns player state, queues, controls, and music metadata; no sensitive form-field collection path is established. — common.3475fd4e.js:reachable content-script paths
Service-specific code resolves music metadata and player information rather than general page forms. — adapter.4aa42674.js:reachable adapter paths
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension stores its settings, session analytics state, and music-tab playback metadata locally, but the reviewed runtime does not establish reading cookies, browsing history, bookmarks, downloads, or authentication sessions. Optional permissions show possible capability, not actual use.
Initial permissions are storage and scripting; tabs and broad host permissions are optional and require user approval. — manifest.json:permissions and optional_permissions
Observed privileged behavior uses storage, tabs/windows, notifications, scripting, and music-service operations; no cookie/history/bookmark/download reader was established. — static/background/index.js:reachable store and handlers
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends music metadata and telemetry outside the browser. Selected track, artist, album, duration, artwork, and link information can go to SynQ’s redirect service, while event data and an extension-generated session identifier go to Google Analytics; music-service requests also resolve links and metadata.
Constructs a synqapp.io redirect URL from selected track, album, artist, duration, artwork, identifiers, and link type. — common.3475fd4e.js:reachable redirect handler
Posts analytics events to Google Analytics and may fetch a supplied album-art URL for notifications. — static/background/index.js:reachable analytics and notification handlers
Performs music-service searches and link-resolution requests. — adapter.4aa42674.js:reachable service adapters
Does it download or run code, settings, or instructions supplied by a remote server?
The extension runs bundled scripts, including dynamically registered MAIN-world adapters, and parses remote music-service responses. The reviewed runtime does not establish downloading JavaScript, settings, or instructions from a server and executing them as code.
Registers extension-bundled adapter scripts; this is not remote-code loading. — static/background/index.js:dynamic script registration and handlers
Remote responses are used for music metadata and link resolution rather than passed to an execution sink. — adapter.4aa42674.js:reachable fetch and parsing paths
Declared executable resources are extension-packaged files. — manifest.json:service worker and content_scripts
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
After setup and any required permission approval, it performs background actions without asking for a new prompt each time, such as tracking playback, updating stored tab state, resolving links, showing notifications, and making service requests. Some navigation and control actions still require a user action or page event.
Background logic updates tracked tabs, handles redirects, sends analytics, creates notifications, and performs tab/window operations. — static/background/index.js:reachable initialization and handlers
Page events and playback state trigger metadata updates and music-control messaging. — common.3475fd4e.js:reachable controller paths
User-facing UI can create, activate, reload, or update supported music-service tabs. — popup.100f6462.js:reachable popup controls
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is harder to inspect because the extension uses very large generated or minified bundles, including the service worker, popup, options, content scripts, and adapters. This is an auditability limitation, not evidence that the code is malicious.
The service worker is a large generated bundle containing initialization, messaging, storage, and privileged handlers. — static/background/index.js:1
The adapter bundle is large and combines service-specific code with library code. — adapter.4aa42674.js:1
The popup application is a multi-megabyte bundled script. — popup.100f6462.js:1
The options application is a multi-megabyte generated bundle. — options.95eda3f3.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No reviewed runtime path establishes eval(), new Function(), or string-based timers converting text into executable code. The extension does execute its packaged bundles, but that is ordinary extension loading and not evidence of dynamic text-to-code execution.
Mapped handlers and initialization do not establish a dynamic code-execution sink. — static/background/index.js:reachable service-worker paths
Mapped page/controller logic uses packaged code and parsed service data, without an established eval-like operation. — common.3475fd4e.js:reachable content paths
Mapped UI behavior does not establish string-based code execution. — popup.100f6462.js:reachable UI paths
Does it track the websites, pages, searches, or links you visit?
It tracks activity on supported music services by reading current tracks, artist and album details, playback state, queues, and related interactions. This state is persisted locally and selected events are sent to analytics; the reviewed code does not establish tracking of every website.
Reads current track and player state and dispatches updates for supported music-service tabs. — common.3475fd4e.js:reachable tab/controller paths
Stores tracked tab state and records track-played and other analytics events. — static/background/index.js:reachable store and analytics paths
Automatic content-script matches are limited to four music services and SynQ redirect pages. — manifest.json:content_scripts
Does it create a persistent ID or browser fingerprint to recognize you?
It creates and persists an extension analytics session identifier, which can recognize events as belonging to the same session. The reviewed code does not establish browser fingerprinting or a permanent account-linked identifier.
Reads and writes session timestamp/data in extension storage and includes a session_id in analytics requests. — static/background/index.js:reachable analytics helper
UI events include session_id and engagement timing before being forwarded for analytics. — options.95eda3f3.js:reachable analytics paths
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension sends selected music metadata and analytics outside the browser, but the reviewed code does not establish sending cookies, authentication tokens, signed-in session details, or arbitrary page contents. Service requests use ordinary web fetch behavior rather than a demonstrated credential-export path.
Shares selected track, artist, album, duration, artwork, and link-type metadata with SynQ’s redirect page. — common.3475fd4e.js:reachable redirect handler
Sends analytics and resolves supplied music metadata; no cookie or token extraction path is established. — static/background/index.js:reachable analytics and redirect handlers
Mapped music-service requests support metadata searches/resolution and do not establish export of authentication data. — adapter.4aa42674.js:reachable service requests
Does it record typing, form entries, clipboard contents, or screenshots?
No mapped behavior records typing, form entries, clipboard contents, or screenshots. The extension does inspect music-player state and metadata, which is different from recording user input.
Mapped content behavior reads track and playback state and routes player-control messages. — common.3475fd4e.js:21
Mapped privileged handlers concern music controls, notifications, tabs, settings, redirects, and analytics. — static/background/index.js:1,5
Can a website or remote server send commands that make the extension take actions?
Allowed music-service pages can message the extension hub, and background handlers can perform privileged tab, window, notification, storage, and music-related actions. The exact external-message validation and handler table remain unresolved, so broader remote command capability cannot be confirmed completely.
External connections are permitted from Apple Music, Spotify domains, YouTube Music, and Amazon Music. — manifest.json:externally_connectable
The service worker receives external connections and routes named messages to privileged handlers. — static/background/index.js:onConnectExternal and runtime handlers
The hub maps connected tabs and forwards payloads between supported contexts. — common.3475fd4e.js:hub forwarding paths
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It changes navigation for its music-sharing feature by creating SynQ redirect links and resolving destination-service links. No evidence shows ad injection, referral-code manipulation, shopping-cart changes, or search-result tampering.
Redirect handling builds a https://www.synqapp.io/redirect URL from music metadata. — common.3475fd4e.js:21
GET_REDIRECT_LINK selects an adapter and resolves track, album, or artist destination links. — static/background/index.js:5
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It can navigate or update pages for music sharing and redirect flows, including moving a tab to SynQ or an extension tab. The reviewed manifest and runtime do not establish request-header modification, download interception, or proxy-setting changes.
Sharing constructs a SynQ redirect URL and navigates the page to it. — common.3475fd4e.js:reachable redirect flow
Background code can update a tab to a constructed extension tab URL. — static/background/index.js:reachable REDIRECT_TO_TAB handler
No webRequest, downloads, or proxy permission is declared. — manifest.json:permissions and optional_permissions
Can it communicate with software on the computer or services running on localhost?
No mapped native-messaging connection, localhost request, or communication with computer software was found. Network activity is directed to music services, SynQ, artwork URLs, and Google Analytics.
Mapped network sinks include Google Analytics, redirect resolution, and album-art fetching. — static/background/index.js:5
Reachable adapter requests target music.youtube.com and music.amazon.com. — adapter.4aa42674.js:1,17
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No mapped behavior decodes or decrypts hidden data and then executes or injects it. The background does register bundled scripts in the page's MAIN world, but the reviewed inventory does not show a hidden-payload execution chain.
The background registers bundled adapter scripts in MAIN world on supported music domains. — static/background/index.js:21
Mapped content behavior bootstraps adapters and page event bridges; no hidden-data execution was identified. — common.3475fd4e.js:21
Can ordinary websites access privileged extension features through messaging or exposed files?
Pages on specifically allowlisted music origins can connect to the extension and send messages that the background hub or handlers process. The manifest does not generally expose privileged messaging to every website, and web-accessible images or styles do not themselves expose extension APIs.
External messaging is allowlisted to specified music origins; web-accessible resources are limited to listed assets and matches. — manifest.json:externally_connectable and web_accessible_resources
The service worker accepts external connections and routes messages to privileged handlers or the hub. — static/background/index.js:external connection and message handling
Connected supported pages can relay payloads through the hub. — common.3475fd4e.js:hub forwarding paths
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Some behavior depends on settings, user permissions, active tabs, and feature events; analytics also records feature-specific events. No evidence was found of date-based or user-targeted malicious activation.
Notifications and analytics activate conditionally based on settings, active/popup state, and track-played events. — static/background/index.js:1,5
Broad host, tabs, and notification capabilities are requested only through a user-facing permission flow. — popup.100f6462.js:1502
Onboarding records permission acceptance and requests optional permissions interactively. — tabs/onboard.4e71ef57.js:1560,1576
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency mining or other hidden resource-intensive computation was identified. The persistent work is music-player monitoring, metadata resolution, storage synchronization, and analytics.
Content initialization observes music-player state and dispatches track/playback updates. — common.3475fd4e.js:21
Background activity covers messaging, storage, notifications, redirects, and analytics. — static/background/index.js:1,5
Does it change form fields or where a form sends its information?
No evidence shows it changing form fields or form destinations. Its navigation changes are music-sharing redirects, not ordinary form submission handling.
Mapped redirect behavior navigates to SynQ using URL parameters derived from music metadata. — common.3475fd4e.js:21
The redirect script reads URL parameters, requests a resolved link, and emits a page event; it does not handle form fields. — redirect.62a03053.js:1