Is FACEIT FORECAST safe?
We analyzed FACEIT FORECAST version 2.0.0's actual code and gave it a 72/100 trust score. A Faceit-only statistics extension with moderate access and no…
Bottom line
A Faceit-only statistics extension with moderate access and no confirmed abuse, but meaningful uncertainty from compressed code and unclear data sharing.
What it can access
It can read and change Faceit pages, observe selected Faceit service traffic, and save data locally. This is broadly relevant to detailed statistics, but it may handle account-related and activity data on that site.
Signs of misuse
No confirmed evidence shows credential theft, form capture, traffic manipulation, hidden mining, or remotely supplied code being run. It does create a persistent installation ID and contact its own services; the compressed files leave some data-sharing details unclear.
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs automatically on Faceit pages, can read and change those pages, and can store extension data locally; that access is broadly proportionate for providing detailed Faceit statistics.
Declares the storage permission and two content scripts matching https://www.faceit.com/*, both running at document_start; one runs in the MAIN world. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on the listed websites after any required approval.
Content scripts run directly on: https://www.faceit.com/*, https://www.faceit.com/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence was found that the extension reads passwords, payment details, messages, or arbitrary form entries. The available source evidence only shows monitoring selected Faceit API responses and request bodies.
Hooks XMLHttpRequest traffic on Faceit pages, matching specific Faceit API URL patterns; it parses selected response bodies and captures request bodies only for non-GET/HEAD latency/ping-related endpoints. — src/faceit/api/network-hook.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence was found in the manifest or package for this capability.
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension is configured to connect to several external fforecast.net and fforecast.dev services, but the available evidence does not show which data is sent or the purpose of each request. The network hook itself observes Faceit API data but does not demonstrate outbound transmission.
The extension's policy allows connections to api.fforecast.net, api.fforecast.dev, api2.fforecast.dev, auth.fforecast.net, auth.fforecast.dev, auth2.fforecast.dev, and CDN hosts. — manifest.json:1
Captures selected Faceit API response data and some request bodies, then dispatches it internally as forecast:apiRaw events; this file does not itself send that data outside the browser. — src/faceit/api/network-hook.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence shows the extension downloading or executing remote code, settings, or instructions as code. It does contact its own servers for authentication, endpoint selection, and optional settings synchronization.
The service worker fetches fixed extension-service endpoints such as /v2/extension/resolve, authentication URLs, and /v1/auth/sync; responses are parsed as JSON and used for authentication or stored settings, not executed as scripts. — src/background/worker.js:1
The manifest lists only packaged JavaScript files and a restrictive extension-page CSP with script-src 'self', providing no remote script source. — manifest.json:1-2
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The extension can act without a fresh, direct request each time: it periodically contacts its servers and can open authentication or banner tabs. These actions are limited to the extension's own flows, but opening pages is still an automatic browser action.
Startup, installation, and timer logic calls endpoint health checks and synchronization automatically; the worker also sets periodic intervals for these operations. — src/background/worker.js:1
The OPEN_BANNER_TAB message handler validates a supplied HTTP(S) URL and calls tabs.create with active:false, opening a background tab. — src/background/worker.js:1
The START_AUTH_V3 handler calls tabs.create({url:n}) to open an authentication page when the extension's flow requests authentication. — src/background/worker.js:1
The content script runs automatically at document_start on every https://www.faceit.com/* page, and the manifest grants storage permission; no evidence shows search redirection or automatic file downloads. — manifest.json:1-2
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Some packaged behavior is difficult to inspect automatically.
This file is heavily minified into an unusually long line. — forecast.js:1
This file is heavily minified into an unusually long line. — src/background/worker.js:3
This file is heavily minified into an unusually long line. — src/visual/popup.html:1
This file is heavily minified into an unusually long line. — src/visual/popup.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No direct indicators were found in readable source files or the manifest.
Does it track the websites, pages, searches, or links you visit?
The extension monitors selected Faceit API requests and captures their response data in the page, including search, ranking, friend, match, and player-statistics requests. The available evidence does not show that this captured browsing data is sent to a tracking or analytics service, so broader visit tracking cannot be confirmed.
The network-hook content script runs at document start on every https://www.faceit.com/* page in the page's MAIN world. — manifest.json:35-48
The hook matches Faceit API paths including searcher, friends, global ranking, match, match history, and player-statistics endpoints; it reads matching XHR responseText and dispatches the resulting URL and data as forecast:apiRaw events. — src/faceit/api/network-hook.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
The extension creates a persistent device ID and saves it in browser storage. It sends that ID to the extension’s own backend services, apparently to associate requests and authentication with the installation; the reviewed evidence does not show browser-fingerprint collection.
The code reads `deviceId` from extension storage and, when absent, generates/registers an ID and stores it with `storage.local.set({deviceId:n})`. — forecast.js:1
Requests to the extension service include the identifier in an `X-Device-ID` header, including the `/v3/link/begin` request. — src/background/worker.js:1
The background code retrieves `deviceId` from `storage.local` and uses it for subsequent API requests. — src/background/worker.js:3
The popup defines `deviceId` as persistent extension state and sends it as `X-Device-ID` when requesting account-related data from the extension API. — src/visual/popup.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
I cannot safely determine whether the extension sends cookies, session data, authentication information, or page contents elsewhere because the relevant source code could not be inspected. The manifest shows connections to the extension's own API and authentication domains, but that alone does not establish that browser credentials or page contents are transmitted.
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence was found that the extension records typing, form entries, clipboard contents, or screenshots. Its page-side hook reads selected Faceit API responses and some request bodies for API telemetry, not keyboard, form, clipboard, or screen data.
The hook intercepts XMLHttpRequest traffic matching configured Faceit API paths, parses matching response JSON, and forwards selected API data through page events. For matching non-GET/HEAD ping requests it forwards the string request body; — src/faceit/api/network-hook.js:1
Can a website or remote server send commands that make the extension take actions?
The available source evidence does not show a website or remote server sending commands to control the extension. The only matching message listener appears to handle messages from an extension-created frame for resizing/navigation behavior, not an external command interface.
The matching code registers a window message listener, but the available minified line is insufficient to establish that arbitrary website or server messages trigger privileged extension actions. — forecast.js:11
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence was found that the extension modifies links, referral codes, advertisements, shopping carts, or search results. The reviewed page script hooks Faceit API requests to collect response data for its statistics features, rather than changing page navigation or content.
The script replaces XMLHttpRequest.open only to observe matching Faceit API responses and dispatch internal forecast events; it does not modify URLs, links, advertisements, carts, or search results. — src/faceit/api/network-hook.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No direct indicators were found in readable source files or the manifest.
Can it communicate with software on the computer or services running on localhost?
No direct indicators were found in readable source files or the manifest.
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The observed decoding only converts URL-encoded cookie values or player URL segments into ordinary text. No evidence shows that decoded data is executed as code or injected as executable content.
decodeURIComponent is applied to a value read from a Faceit cookie, returning the decoded cookie text. — forecast.js:1
decodeURIComponent is applied to the player identifier captured from an href path; this is URL parsing, not code unpacking or execution. — forecast.js:11
Can ordinary websites access privileged extension features through messaging or exposed files?
The available evidence does not show an ordinary website reaching privileged extension APIs. However, the extension injects a web-accessible script that sends messages to its parent with a wildcard target, and the bundled code is too compressed to establish the surrounding trust checks confidently.
The manifest exposes selected configuration, localization, image, and popup files to pages matching https://www.faceit.com/*; it does not expose these resources to arbitrary origins. — manifest.json:47-70
Compressed code contains a generated bridge that calls parent.postMessage(..., "*") for click-related data. The surrounding iframe/page context and any receiver or privileged action could not be established from the available representative — forecast.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence shows suspicious behavior gated to particular users, websites, dates, or remote settings. The date checks found appear to support throttling, timestamps, or locale caching rather than selectively activating harmful behavior.
Date.now() is used to throttle a domain recheck based on elapsed time; this is ordinary request-rate control, not a user/date trigger. — forecast.js:1
Date.now() is used to throttle background work and manage stored state, with no indication of selective suspicious activation. — src/background/worker.js:1
Date.now() is used to determine whether cached locale data is fresh and to timestamp refreshed data. — src/visual/popup.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No direct indicators were found in readable source files or the manifest.
Does it change form fields or where a form sends its information?
No reliable source evidence was available to confirm that the extension changes form fields or a form's submission destination. The available package context shows no form-handling behavior.