Is Profile Scraper for LinkedIn™ safe?
We analyzed Profile Scraper for LinkedIn™ version 1.6.0's actual code and gave it a 62/100 trust score. This is a purpose-aligned LinkedIn scraper with…
Bottom line
This is a purpose-aligned LinkedIn scraper with medium access risk and meaningful privacy concerns from analytics collection.
What it can access
It can read LinkedIn pages, detailed profiles, and session-cookie data needed for authenticated exports, which is powerful but narrowly tied to its stated feature.[Q1][Q3][Q14]
Security weaknesses
It reads LinkedIn session-cookie data for authenticated requests, while large bundled code is harder to inspect if the extension is compromised.[Q14][Q10]
Signs of misuse
It sends search details, scraping activity, a persistent device ID, and signed-in email or account identity to analytics services beyond the export feature.[Q6][Q12][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests LinkedIn host access, LinkedIn content-script access, cookies, storage, and Google identity. Those powers support scraping and Pro sign-in, but cookie access and authenticated automation make the impact of misuse high.
Declares cookies, storage, identity, LinkedIn host access, a LinkedIn document-start content script, and Google openid/email/profile scopes. — manifest.json:permissions, host_permissions, content_scripts, and oauth2
Reads JSESSIONID and performs credentialed LinkedIn Voyager requests. — tabs/exportTab.3ccf4252.js:exportTab application module
Which websites can it run on, and can it read or change what appears on those pages?
It injects an export button and start-page dialog into LinkedIn people-search result pages. It does not rewrite profile content, existing inputs, links, or forms.
Mounts a Plasmo/Vue overlay, watches LinkedIn navigation, and displays its export controls on results/people URLs. — plasmo-inline.7c919a8b.js:content-script App module
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It accesses LinkedIn search terms and geographic filters, JSESSIONID, authenticated services responses, and profile fields including names, URLs, headlines, network distance, location, images, followers, education, and employment. Optional Pro sign-in accesses Google email/profile identity.
Reads keywords and geoUrn from the LinkedIn search URL and stores them for the export tab. — plasmo-inline.7c919a8b.js:startExporting
Parses detailed profile and relationship fields from LinkedIn GraphQL responses. — tabs/exportTab.3ccf4252.js:requestSearchPeopleResult, requestProfilePartOne, and requestProfilePartTwo
Requests a Google ID token with openid, email, and profile scopes. — static/background/index.js:signInWithGoogle handler
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores search terms, geographic filters, starting page, rate-control settings, review/free-limit state, Pro status, Google/Supabase auth state, Mixpanel identity, and subscription data. Scraped profiles are held in the export tab and written to CSV on demand.
Stores searchResultsPeopleKeywords, searchResultsPeopleGeoUrn, and startPage in chrome.storage.local. — plasmo-inline.7c919a8b.js:startExporting
Persists Supabase sessions in local storage and stores isPro plus rate settings in extension storage. — popup.588cc70c.js:Supabase client and Settings/Pro modules
Accumulates profile records in memory and creates a local CSV download. — tabs/exportTab.3ccf4252.js:profileArray and exportCSV
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares no capture or sensor permission. — manifest.json:permissions
No getUserMedia, getDisplayMedia, or geolocation call was found. — *.js:media API review
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Authenticated profile queries go to LinkedIn. Mixpanel automatically receives page/usage events and explicit data containing search keywords, geographic filters, counts, error text, and sometimes a profile vanity name; signed-in email and Supabase user ID are also tracked.
Initializes Mixpanel with localStorage persistence and tracks requestSearchPeopleResult, processCatchError, exportCSV, extension_version, and page views. — tabs/exportTab.3ccf4252.js:Mixpanel initialization and exportTab events
Tracks a User event containing Supabase userId and email. — popup.588cc70c.js:Pro auth-state handler
Adds email, user_id, and product name to the Lemon Squeezy checkout URL. — popup.588cc70c.js:Pro subscribe
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All extension entry points are packaged files. — manifest.json:background and content_scripts
No eval, Function constructor, or string-based timer was found. — *.js:dynamic-code review
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The LinkedIn overlay loads automatically, but scraping starts after the user chooses Export and confirms a start page. The export then automatically makes repeated authenticated requests until the free/Pro limit, completion, pause, or a rate/error condition.
Watches page navigation and opens the export tab after the user's dialog action. — plasmo-inline.7c919a8b.js:mounted, downloadProfiles, and startExporting
Automatically dispatches search and two profile requests per result with randomized delays and periodic cooldowns. — tabs/exportTab.3ccf4252.js:request scheduling functions
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, search, privacy, management, webRequest, or declarativeNetRequest permission. — manifest.json:permissions
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The content, popup, and export code is bundled and heavily minified with large embedded Vue, PrimeVue, Supabase, and Mixpanel libraries and no source maps. Core application modules and data flows remain identifiable.
A roughly 2.7 MB production-minified bundle includes UI, Supabase, Mixpanel, and app logic. — popup.588cc70c.js:entire file
A roughly 875 KB production-minified bundle includes scraper, export, and telemetry logic. — tabs/exportTab.3ccf4252.js:entire file
Lists no source maps. — inventory.json:files
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Application and bundled-library code contains no text-to-code sink. — *.js:dynamic-code review
Does it track the websites, pages, searches, or links you visit?
It does not track general browsing outside LinkedIn, but it automatically reports extension page views and scraping activity to Mixpanel, including the LinkedIn search keyword, geographic filter, start position, result count, and some error/profile context.
Limits webpage access to LinkedIn subdomains. — manifest.json:content_scripts and host_permissions
Enables automatic pageview tracking and submits request/error/export events with search and scraping context. — tabs/exportTab.3ccf4252.js:Mixpanel initialization and track calls
Does it create a persistent ID or browser fingerprint to recognize you?
Mixpanel creates a persistent localStorage-backed device/distinct ID and attaches it to analytics. If the user signs in, the extension additionally sends Supabase user ID and email in a User event.
Initializes Mixpanel with a fixed project token, pageview tracking, and localStorage persistence. — tabs/exportTab.3ccf4252.js:mixpanel module lAv2V
Calls Mixpanel track('User', {userId, email}) after a Supabase session becomes active. — popup.588cc70c.js:Pro auth-state handler
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads LinkedIn's JSESSIONID cookie and uses the browser's LinkedIn cookies for authenticated Voyager requests. I found no path sending those cookies to the developer.
Calls chrome.cookies.get for JSESSIONID and removes quotes to form LinkedIn's csrf-token header. — tabs/exportTab.3ccf4252.js:onMounted and controlExport
Uses credentials: include only on fixed linkedin.com Voyager URLs. — tabs/exportTab.3ccf4252.js:LinkedIn fetch calls
Obtains an ID token through chrome.identity for Supabase sign-in. — static/background/index.js:signInWithGoogle
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Creates a Blob/object URL for the user-requested CSV export. — tabs/exportTab.3ccf4252.js:DataTable exportCSV
Requests no clipboard or capture permission. — manifest.json:permissions
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Parses fixed LinkedIn GraphQL response structures into profile rows and workflow decisions. — tabs/exportTab.3ccf4252.js:request functions
Reads the authenticated in_profile_scraper_payment record to decide whether Pro limits apply. — popup.588cc70c.js:getSubscribeInfo
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds an export overlay without rewriting LinkedIn result links. — plasmo-inline.7c919a8b.js:content-script App
Opens explicit fixed Lemon Squeezy checkout URLs after the user clicks Subscribe. — popup.588cc70c.js:Pro subscribe
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no webRequest, declarativeNetRequest, debugger, downloads, or proxy permission. — manifest.json:permissions
Uses ordinary fetch against fixed linkedin.com GraphQL endpoints. — tabs/exportTab.3ccf4252.js:request functions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is declared. — manifest.json:permissions
The active application client is configured for qurgxyievnxstbfbqrnu.supabase.co. — popup.588cc70c.js:Supabase client module
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Extracts a Google id_token from the identity redirect and stores it for Supabase sign-in. — static/background/index.js:OAuth callback
No decoded value flows to eval, Function, script injection, or a string timer. — *.js:execution-sink review
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable declaration. — manifest.json:top-level fields
Handles only signInWithGoogle and startExporting actions. — static/background/index.js:runtime.onMessage
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Uses randomized 8–40 second waits, periodic configured cooldowns, occasional 30–60 second pauses, and a 15-minute cooldown after rate-limit responses. — tabs/exportTab.3ccf4252.js:randomIntBetween, applySchedulingDelay, nextProfile, and processResponseError
Lets the user configure cooldown minutes and requests per cooldown. — popup.588cc70c.js:Settings
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Repeated work consists of rate-limited LinkedIn search/profile fetches and local table/CSV creation. — tabs/exportTab.3ccf4252.js:export workflow
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The injected overlay contains only the extension's export action and start-page dialog. — plasmo-inline.7c919a8b.js:content-script App
No existing form action rewrite or page submission listener was found in application code. — *.js:form mutation review