Is Economic Calendar TFlab Events (Forex, Crypto & Stock Market) safe?
We analyzed Economic Calendar TFlab Events (Forex, Crypto & Stock Market) version 1.0.5's actual code and gave it a 93/100 trust score. This appears to be…
Bottom line
This appears to be a narrowly scoped calendar extension with no evidence of misuse or meaningful security weaknesses.
What it can access
It contacts TradingFinder for calendar data, stores calendar preferences, and fetches data when opened, all consistent with its purpose.[Q1][Q4][Q6][Q8]
Security weaknesses
No evidence shows executable remote code, privileged commands, or ordinary websites reaching extension features.[Q11][Q16][Q21]
Signs of misuse
No evidence shows tracking or credential collection; requests contain calendar choices and data needed for the feature.[Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can use its own popup and one TradingFinder services origin, with no general browser or website access.
Declares no permissions and grants host access only to https://api.tradingfinder.com/*. — manifest.json:18-29
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts, scripting permission, activeTab, tabs, or broad host access. — manifest.json:1-29
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The package has no page access and operates only in its popup. — manifest.json:1-29
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores theme, language, timezone, country, importance, active-date, and filter preferences in popup localStorage.
Reads and writes localStorage keys including theme, i18nextLng, selectedCountries, importances, timezone, activeTab, and filterParams. — assets/index-D9XsYI7q.js:49
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests no browser permissions. — manifest.json:18-24
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends calendar filters to TradingFinder's services to retrieve the requested events and settings; no unrelated data is added.
Fetches calendar/view with country, date, timezone, and importance query parameters assembled from visible filters. — assets/index-D9XsYI7q.js:49
Fetches only fixed paths under api.tradingfinder.com for calendar data and settings. — background.js:2-24
Does it download or run code, settings, or instructions supplied by a remote server?
TradingFinder supplies calendar settings and event records used in the popup, but not executable behavior.
Downloads and parses the fixed calendar/setting JSON response. — background.js:16-24
Uses returned countries, events, dates, translations, values, and display data. — assets/index-D9XsYI7q.js:49
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Opening the popup automatically fetches settings and matching calendar events when filters are present.
React effects fetch event data when filterParams changes and request settings when the app mounts. — assets/index-D9XsYI7q.js:49
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-settings or proxy permission. — manifest.json:18-24
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains React, i18next, calendar constants, fixed endpoints, filter logic, and readable UI strings. — assets/index-D9XsYI7q.js:1-49
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Loads one packaged module script and packaged stylesheet. — index.html:1-14
Remote responses are parsed as JSON and rendered as calendar data. — assets/index-D9XsYI7q.js:49
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests no tabs, history, webNavigation, or broad host permission. — manifest.json:18-24
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Requests contain calendar filters only; no identifier or telemetry client is created. — assets/index-D9XsYI7q.js:49
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies or page-access permission. — manifest.json:18-29
Calendar requests have no Authorization header or credential payload. — assets/index-D9XsYI7q.js:49
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
It cannot inject into websites and requests no capture permission. — manifest.json:1-29
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Returns parsed API JSON to the popup without interpreting commands. — background.js:2-24
The extension has no privileged browser permissions for a server to exercise. — manifest.json:18-24
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or scripting permission. — manifest.json:1-29
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or downloads permission. — manifest.json:18-29
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:18-24
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Fetches fixed calendar and setting endpoints and parses JSON. — background.js:2-24
Uses the JSON to populate countries, events, importance, dates, values, and timezone-aware display. — assets/index-D9XsYI7q.js:49
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or externally_connectable entry. — manifest.json:1-29
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Provides visible settings panels and saves the selected filters locally. — assets/index-D9XsYI7q.js:49
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Application work consists of filtering, grouping, formatting, and rendering calendar events. — assets/index-D9XsYI7q.js:49
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
It has no external-page injection path; inputs belong only to its popup filters. — manifest.json:1-29