Is Clutch Scraper - Extract Business Database from Clutch.co safe?
We analyzed Clutch Scraper - Extract Business Database from Clutch.co version 1.3.2's actual code and gave it a 84/100 trust score. This is a…
Bottom line
This is a purpose-aligned Clutch scraper with moderate site access, limited evidence of misuse, and no confirmed serious security weakness.
What it can access
It can read Clutch pages, automate scraping, and store results locally, which fits its stated purpose but still grants meaningful access to those pages.[Q1][Q2][Q4]
Security weaknesses
Large bundled files make review harder, but no dangerous code execution, broad site access, or exposed privileged interface was established.[Q10][Q11][Q16][Q21]
Signs of misuse
The extension contacts its provider for licensing and optional account features, but no evidence shows sensitive collection, tracking of other sites, or remote commands.[Q6][Q12][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests local storage and persistent storage plus access to Clutch pages; those permissions are proportionate to saving large scrape jobs.
Declares storage, unlimitedStorage and a content script/host permission limited to *.clutch.co. — manifest.json:19-41
Stores the job queue and result objects under his_q and his_m_<job id> keys while the scraper runs. — dist/contentScripts/index.global.js:168
Which websites can it run on, and can it read or change what appears on those pages?
It can read and add its scraper interface to Clutch pages, but it has no access to unrelated websites.
Limits host access and content-script execution to Clutch subdomains. — manifest.json:23-41
Mounts the scraper UI in a shadow root only when an exp marker is present and the target Clutch URL passes validation. — dist/contentScripts/index.global.js:263
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The custom page logic fetches and parses business directory pages; no key, input or form-submission listener collects typed website data. — dist/contentScripts/index.global.js:133-168
No cookies, clipboard or broad-site permission is requested. — manifest.json:19-41
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It saves scrape history and extracted business records locally, but it cannot use the browser cookie, history, bookmark or downloads services.
Uses storage.local for the job queue and per-job result objects. — dist/contentScripts/index.global.js:168
Declares storage permissions only; cookies, history, bookmarks and downloads are absent. — manifest.json:19-25
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
None of the corresponding privileged permissions is declared. — manifest.json:19-25
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It contacts Clutch for the requested scrape and Niomaker for licensing, optional account lookup and product recommendations; scraped records are not sent to Niomaker.
Defines the Niomaker API and Clutch directory endpoints; licensing sends app ID and a locally generated UID. — dist/contentScripts/index.global.js:120-133
Calls /v for subscription state, /token with user-entered order ID and email, and /t for recommendation cards. — dist/assets/popup.776e2126.js:14
Scraped rows are written to extension storage and passed to local export helpers rather than to the developer API. — dist/contentScripts/index.global.js:168
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads subscription settings and recommendation cards, but not executable code or scraping instructions.
The /v response supplies paid-plan/configuration data and /t supplies display text, icons and URLs for a More page. — dist/assets/popup.776e2126.js:14
Extension pages restrict scripts to packaged self content. — manifest.json:54-56
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
After the user starts an export, it automatically paginates and fetches many Clutch pages; that automation is the visible purpose of the tool.
The Export Leads button validates the entered Clutch URL, adds export/count parameters and opens the job tab. — dist/assets/popup.776e2126.js:14
The marked tab iterates Clutch directory and company-detail requests while showing progress and handling rate limits. — dist/contentScripts/index.global.js:133-168
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser-settings, proxy, search-provider or privacy permission is present. — manifest.json:19-25
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The popup and page access are large minified bundles containing Vue, Ant Design, SheetJS, Moment, Lodash and compatibility code, which makes review harder.
A roughly 1.6 MB generated bundle mixes application code with multiple third-party libraries. — dist/contentScripts/index.global.js:1-263
The popup is another roughly 1.6 MB bundled/minified application. — dist/assets/popup.776e2126.js:1-229
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains Function("return this") and Function("r", "regeneratorRuntime = r") calls with constant packaged strings. — dist/contentScripts/index.global.js:4, 6, 69, 168
Contains equivalent fixed runtime/global-detection fallbacks; no eval call or dynamic source string was found. — dist/assets/popup.776e2126.js:14, 16, 79, 130
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Website access is limited to Clutch. — manifest.json:23-41
Outbound developer calls are licensing-related; scrape targets and results stay in local job storage. — dist/contentScripts/index.global.js:120-168
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a persistent random UUID and sends it to Niomaker to identify the installation for subscription checks and checkout.
Creates a UUID, stores it under key t and sends it as uid with app=87 to the /v endpoint. — dist/contentScripts/index.global.js:120
Uses the same UID for plan checks and checkout; a successful account switch replaces it with the server-returned UID. — dist/assets/popup.776e2126.js:14
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
The extension has no cookies permission. — manifest.json:19-25
Clutch data flows to local storage/export, while Niomaker requests carry licensing fields rather than page content. — dist/contentScripts/index.global.js:120-168
The optional account-switch request sends the email and order ID typed into the extension UI, not credentials harvested from a website. — dist/assets/popup.776e2126.js:14
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Custom scraping code reads rendered business listings and details; no typing, paste, clipboard or capture sink was found. — dist/contentScripts/index.global.js:133-168
No clipboard or tab-capture permission is requested. — manifest.json:19-25
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Remote fields are consumed by subscription and More-page UI code, not dispatched as commands. — dist/assets/popup.776e2126.js:14
No externally_connectable rule or externally callable privileged interface is declared. — manifest.json:1-56
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The content code parses business links and displays its own scraping controls without changing Clutch destinations or commerce flows. — dist/contentScripts/index.global.js:133-168
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It initiates local downloads of user-requested CSV, JSON or XLSX exports, but does not intercept traffic, alter headers or use a proxy.
Creates Blob URLs and clicks a temporary download link; SheetJS includes a downloads-API fallback, but that permission is not declared. — dist/contentScripts/index.global.js:168, 179
No webRequest, declarativeNetRequest, proxy or downloads permission is requested. — manifest.json:19-25
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging or localhost host access is declared. — manifest.json:19-25
Observed application endpoints are HTTPS services at Clutch and Niomaker. — dist/contentScripts/index.global.js:120-168
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Dynamic Function matches use fixed packaged strings; fetched Clutch and Niomaker data is parsed as records or UI data. — dist/contentScripts/index.global.js:4, 6, 69, 168
The extension-page content security policy permits packaged scripts only. — manifest.json:54-56
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Makes the content-script stylesheet and assets/* web-accessible on <all_urls>. — manifest.json:43-52
No externally_connectable entry grants ordinary websites runtime messaging access. — manifest.json:1-56
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Requires the exp query marker and a valid Clutch URL before mounting the scraper. — dist/contentScripts/index.global.js:263
The marker is added when the user presses Export Leads. — dist/assets/popup.776e2126.js:14
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The row-count controls include presets up to 100k before opening the export job. — dist/assets/popup.776e2126.js:14
Automates listing/detail fetches and waits after 400, 403 and 429 responses according to settings. — dist/contentScripts/index.global.js:133-168
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Website-facing code parses Clutch pages and mounts an isolated scraper UI; no host-page form action/value rewrite or submission hook was found. — dist/contentScripts/index.global.js:133-168, 263