Is Twitch™ Chat Translator - Auto Translate Live Chat in Real Time safe?
We analyzed Twitch™ Chat Translator - Auto Translate Live Chat in Real Time version 1.18.0's actual code and gave it a 74/100 trust score. This is a…
Bottom line
This is a mostly purpose-aligned Twitch translator with moderate privacy and security concerns.
What it can access
It runs only on Twitch, but reads chat and sometimes drafts and sends them to translation services as its core feature.[Q1][Q2][Q3][Q6]
Security weaknesses
Remote selectors can broaden what Twitch content is read, while any Twitch page code can trigger translation and optional sending.[Q16][Q21]
Signs of misuse
No clear misuse is established; chat and draft text go to translation providers for the advertised feature, with optional account data used for its own service.[Q3][Q6]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs on all HTTPS Twitch subdomains, stores its own settings, and can use Chrome Identity for optional Google sign-in. Its scope is narrow for a Twitch translator and excludes cookies, history, tabs, and all-sites access.
Declares storage and identity, a translate.google.com host permission, and three content scripts limited to https://*.twitch.tv/*. — manifest.json:15-50
Describes a Twitch chat translator with incoming and outgoing translation features. — _locales/en/messages.json:8-16,193-199,279-282
Which websites can it run on, and can it read or change what appears on those pages?
It reads visible Twitch chat messages and the Twitch chat input. It does not run on other websites, and reviewed application code does not collect unrelated Twitch page content under the current selectors.
Selects new chat-message elements, reads their textContent, and submits that text for translation. — Translator.7f0b6bc1.js:1
Reads the configured contenteditable Twitch chat input for outgoing translation preview. — InputTranslator.c7546567.js:2
Limits all content scripts to Twitch HTTPS subdomains. — manifest.json:25-44
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Chat messages and outgoing drafts may contain personal or sensitive text. The extension sends that text for translation, but only as part of its stated feature and under translation settings.
Copies visible chat message text into a translate runtime request. — Translator.7f0b6bc1.js:1
Copies the current outgoing chat draft into a translate runtime request when paid preview is active. — InputTranslator.c7546567.js:2
Discloses real-time preview, instant sending, and incoming/outgoing translation controls. — _locales/en/messages.json:94-121,193-199
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It uses extension-local storage for language settings, billing state, usage counters, remote selectors, cached translations, and an optional account session. It cannot read general browser history, bookmarks, cookies, or saved passwords.
Requests storage and identity but none of the general browser-data permissions. — manifest.json:15-24
Persists translation settings, billing/configuration state, cache entries, and Supabase session data in extension storage or IndexedDB. — Translator.7f0b6bc1.js:36,49
Stores translated text in an IndexedDB cache capped at 200 entries. — static/background/index.js:13
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the relevant file, download, clipboard, geolocation, media, or native permissions. — manifest.json:15-50
Creates an in-page DataTransfer containing the translated text; it does not read the system clipboard. — InputTranslator.c7546567.js:2
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends Twitch chat text or draft text to Google, Microsoft, or Yandex for translation. These are feature-related destinations, not covert collectors.
Receives translate requests, checks the local cache, calls the selected provider, and tries Google/Google2 fallbacks after an error. — static/background/index.js:13
POSTs or GETs the supplied texts to Google, Microsoft Translator, or Yandex translation endpoints. — static/background/index.js:70-75
Creates translate requests directly from Twitch chat-message text. — Translator.7f0b6bc1.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It downloads vendor configuration for billing, promotions, subscription status, and Twitch page selectors. These responses change settings and page targeting but are not executed as JavaScript.
Fetches project configuration and custom configuration from worker-api.extbolt.com. — Translator.7f0b6bc1.js:49
Stores the returned customConfig and uses remote product URLs for the upgrade interface. — Translator.7f0b6bc1.js:49
Reads customConfig from local extension storage as CSS selectors. — InputTranslator.c7546567.js:69
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
When incoming translation is enabled, it automatically watches Twitch for new chat messages and sends batches for translation. This is enabled by the default setting, bounded by a daily free limit, and matches the advertised feature.
Uses a throttled MutationObserver to find untranslated chat nodes and submit their text automatically. — Translator.7f0b6bc1.js:1
Sets TranslationSwitch true by default and caps free use through CountDaily. — Translator.7f0b6bc1.js:49
Labels the feature as auto-translation of incoming and outgoing messages. — _locales/en/messages.json:193-199
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests none of the browser-setting, proxy, management, or policy permissions. — manifest.json:15-50
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The package contains several large minified Parcel bundles with duplicated React, Supabase, and UI dependencies. This makes review slower, but the application modules and network services remain readable; deliberate concealment was not demonstrated.
Lists multi-megabyte content, options, popup, upgrade, and background bundles. — inventory.json:1-148
Keeps the principal chat observer and remote-configuration modules identifiable inside the bundle. — Translator.7f0b6bc1.js:1,49
Keeps the translation dispatcher and provider endpoints identifiable inside the bundle. — static/background/index.js:13,70-75
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Contains Lodash's fixed Function("return this")() compatibility expression. — Translator.7f0b6bc1.js:32
Contains the same duplicated fixed Lodash expression. — TranslationButton.8010a5f4.js:32
Contains the same duplicated fixed Lodash expression, with no user or server input. — InputTranslator.c7546567.js:35
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Has Twitch content-script scope but no tabs, history, webNavigation, or all-sites permission. — manifest.json:15-50
Translation requests contain texts, languages, and service; project configuration requests contain the fixed project ID. — Translator.7f0b6bc1.js:1,49
Does it create a persistent ID or browser fingerprint to recognize you?
Optional sign-in creates a Supabase account session and subscription checks send its bearer token to the extension vendor. Yandex translation requests also include a fresh random request ID.
Completes optional Google OAuth through Supabase and persists the resulting extension-account session. — static/background/index.js:1,22
Adds the Supabase access token only to authenticated vendor API POST requests. — Translator.7f0b6bc1.js:49
Creates a random per-request UUID for the Yandex translation call. — static/background/index.js:75
Does it send cookies, session details, authentication data, or page contents elsewhere?
It stores and uses an optional Supabase session for its own account and subscription service. It does not request cookies or read Twitch authentication data, and normal OAuth tokens are not sent to an unrelated party.
Uses Chrome Identity for an interactive Google OAuth flow and exchanges the returned code with Supabase. — static/background/index.js:1
Persists the Supabase session in extension-local storage with token refresh enabled. — static/background/index.js:22
Requests identity and storage but not cookies. — manifest.json:15-24
Does it record typing, form entries, clipboard contents, or screenshots?
For paid users with translation preview enabled, it observes changes to the Twitch chat input and sends the current draft for translation. It sends draft snapshots rather than raw keystrokes, is limited to Twitch, and is disclosed as real-time preview; no screenshots or unrelated form capture were found.
A MutationObserver reads the configured chat input's text after changes and submits it in a translate request when paid preview is active. — InputTranslator.c7546567.js:2
Explains that translation preview translates input content in real time. — _locales/en/messages.json:94-100
Confines the observer to Twitch pages. — manifest.json:25-44
Can a website or remote server send commands that make the extension take actions?
The vendor can remotely change CSS selectors that determine which Twitch elements are read, hidden, and modified. That creates a server-controlled data-selection path inside Twitch, but not arbitrary code execution.
Fetches customConfig from the vendor and stores it without a selector allowlist. — Translator.7f0b6bc1.js:49
Uses remote reciveMsgContainer and reciveMsgInsertContainer selectors to choose text to translate and page nodes to modify. — Translator.7f0b6bc1.js:1
Uses the remote inputTextEl selector; the packaged fallback targets Twitch's chat input. — InputTranslator.c7546567.js:2,69
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Marks chat nodes, optionally hides their original body, and appends translations through innerText. — Translator.7f0b6bc1.js:1
Selects the Twitch chat input and dispatches a plain-text paste containing the translated draft. — InputTranslator.c7546567.js:2
Discloses translation preview, instant sending, and automatic translation. — _locales/en/messages.json:94-121,193-199
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It makes expected HTTPS requests to translation, account, configuration, and payment services and can open upgrade or management URLs after a user action. It does not intercept other traffic, rewrite headers, control the proxy, or manage downloads.
Implements the translation network calls and provider fallback. — static/background/index.js:13,70-75
Opens vendor-supplied checkout or subscription-management URLs from explicit upgrade/account controls. — options.95eda3f3.js:25
Declares no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:15-50
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission or localhost host access. — manifest.json:15-50
Reviewed application network paths use public HTTPS translation services. — static/background/index.js:13,70-75
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches custom configuration JSON from worker-api.extbolt.com. — Translator.7f0b6bc1.js:49
Feeds returned selectors into querySelector/querySelectorAll and inserts translations with innerText. — Translator.7f0b6bc1.js:1
The only direct Function constructor is a fixed bundled compatibility expression unrelated to remote data. — Translator.7f0b6bc1.js:32
Can ordinary websites access privileged extension features through messaging or exposed files?
Any script running in a Twitch page can post the fixed translateInput message. The extension does not validate the sender before replacing the chat input with its prepared translation and, if the user enabled instant sending, simulating Enter.
The extension's button and shortcut publish {action: 'translateInput'} through window.postMessage. — TranslationButton.8010a5f4.js:16
Listens to every window message and checks only data.action before selecting the input, pasting the existing translation, and optionally dispatching Enter. — InputTranslator.c7546567.js:2
Limits this bridge to Twitch pages and declares no externally_connectable origins. — manifest.json:25-44
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Collection depends on user settings, paid status for outgoing preview, and vendor-supplied selectors. The current server response used the same chat-only selectors as the packaged defaults.
Gates incoming translation on settings and remote customConfig, then uses that config for DOM selection. — Translator.7f0b6bc1.js:1,49
Gates draft monitoring on paid status, translation switch, preview setting, and customConfig. — InputTranslator.c7546567.js:2
Packages chat-specific fallback selectors and reads the remotely stored customConfig. — InputTranslator.c7546567.js:69
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The recurring observer throttles detection of new Twitch chat messages for translation. — Translator.7f0b6bc1.js:1
Background work handles translation, caching, install cleanup, and message routing. — static/background/index.js:13
Does it change form fields or where a form sends its information?
It monitors and edits Twitch's chat input for outgoing translation. Replacing or sending the draft requires paid preview plus a button, shortcut, or window message, and instant sending is a visible setting.
Observes the configured chat input, previews translations, then selects and pastes translated text; Enter is dispatched only when SendImmediately is enabled. — InputTranslator.c7546567.js:2
Triggers input replacement from the extension button or configured shortcut. — TranslationButton.8010a5f4.js:16
Explains translation preview, instant sending, and the dependency between those settings. — _locales/en/messages.json:94-121