Is Instant Data Scraper safe?
We analyzed Instant Data Scraper version 1.7.1's actual code and gave it a 42/100 trust score. This is a broad, opt-in data-collection extension with…
Bottom line
This is a broad, opt-in data-collection extension with meaningful privacy and control risks beyond ordinary one-click scraping.
What it can access
[Q1] All-site access lets it read pages and monitor navigation, exceeding a simple on-demand scraper despite supporting its core feature.[Q6]
Security weaknesses
[Q7] Remote settings can change what is collected, while [Q16] the packaged interpreter can fetch, read, and upload selected page data.
Signs of misuse
[Q6] After opt-in it sends browsing and page-derived records to the vendor and analytics services, while [Q12] persistent tracking covers visited addresses and referrers.
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests all-site host access plus tabs, webRequest, webNavigation, scripting, storage, alarms, and context menus, and loads three content-script groups on every HTTP(S) page.
Declares broad permissions, <all_urls>, and three all-site content-script entries. — manifest.json:12-82
Which websites can it run on, and can it read or change what appears on those pages?
It can read tables and general page text, HTML, attributes, properties, links, and selector-matched elements. Some reading supports user-requested scraping; additional collection is controlled by opt-in remote rules.
Implements table discovery plus a declarative interpreter with DOM query, XPath, innerText, innerHTML, property, and attribute operations. — src/onload.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Its interpreter can inspect page fields and content, and the consent disclosure covers search and AI requests/responses including attachments. Which sensitive fields are actively collected depends on server-supplied rules that were not packaged.
Provides server-driven selectors and property/text extraction across all pages. — src/onload.js:1
Discloses search terms/results and AI prompts, responses, attachments, and images as collection categories. — _locales/en/messages.json:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores consent, persistent analytics identifiers, feature settings, remote configurations, selected extraction rules, table presets, and work-profile data locally and in sync storage.
Defines and uses local/sync keys for opt-in state, analytics IDs, configurations, table presets, and work-profile data. — src/background.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It creates local CSV and Excel downloads from scraped tables and can fetch or upload blobs under declarative instructions. No camera, microphone, clipboard-read, or native-system access was found.
Builds CSV/XLSX exports and triggers local file downloads. — src/popup.js:1-1201
The declarative interpreter includes remote fetch, blob, compression, and upload operations. — src/onload.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
After opt-in, it sends encrypted-but-vendor-readable navigation and page-derived records to services.idscraper.com with a persistent ID. It also sends product analytics to Google Analytics and Mixpanel.
Builds URL/referrer/navigation payloads, encrypts them with a packaged key, posts them to the vendor, and separately calls Google Analytics and Mixpanel. — src/background.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
It periodically downloads remote extraction configurations, selector mappings, feature flags, site categories, and work-profile data. These are server instructions and data, not demonstrated JavaScript replacement.
Fetches /history/setup, /pages/selections, /remote-config, GrowthBook features, domain classifications, and work-profile responses. — src/background.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Once opted in, collection runs automatically on tab navigation, page loads, redirects, request headers, page events, and periodic timers rather than only when the scraper popup is open.
Registers tabs, windows, webRequest, webNavigation, alarm, and collection listeners and uploads navigation records automatically when optIn is true. — src/background.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no proxy, browserSettings, search override, homepage, or new-tab capability. — manifest.json:1-83
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The collection engine is heavily minified and deliberately disguised with unrelated class and method names; a downloaded mapping changes numeric operation identifiers into meanings. This impedes review but is not by itself proof of malware.
Uses misleading generated names and downloads frequent_selectors mappings. — src/background.js:1
Uses the downloaded mappings to interpret remote extraction operations. — src/onload.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Restricts extension scripts to self under Manifest V3. — manifest.json:25-27
Implements a packaged declarative operation interpreter without an identified text-to-code sink. — src/onload.js:1
Does it track the websites, pages, searches, or links you visit?
It tracks full current URLs, prior-page URLs, referrers, redirect/navigation events, and active-tab changes after opt-in. It does not call Chrome's history services, but reconstructs browsing activity from live navigation.
Observes tabs and main-frame web requests, captures Referer/document.referrer, and adds current and previous URLs to uploaded records. — src/background.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates persistent user/analytics identifiers and attaches an ID to vendor, Mixpanel, and analytics activity, allowing records to be linked over time.
Creates analytics IDs in local and sync storage, sends x-ids-id to the vendor, and uses distinct_id/client_id for analytics. — src/background.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Does not request the cookies permission. — manifest.json:12-23
Can inspect selector-matched DOM properties, but no packaged rule specifically targets passwords or auth tokens. — src/onload.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
The disclosed opted-in collection includes clicks, search terms, and AI prompts/responses with attachments or images. Exact active capture rules are server-controlled, so comprehensive keystroke logging or screenshot capture was not demonstrated.
Explicitly discloses click activity, search terms/results, and AI requests/responses including attachments and images. — _locales/en/messages.json:1
Provides event and DOM extraction primitives selected by downloaded configurations. — src/onload.js:1
Can a website or remote server send commands that make the extension take actions?
The vendor server can choose enabled collection types, URL matchers, selectors, and extraction operations within a powerful packaged interpreter. It cannot be confirmed to run arbitrary JavaScript, but it can materially change what opted-in pages are read and sent.
Downloads configurations with types, buckets, URL matchers, blocking behavior, and queue strategies. — src/background.js:1
Executes declarative selector, DOM traversal, property, fetch, compression, and upload operations. — src/onload.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Adds table/next-button classes and dispatches mouse events for user-configured pagination. — src/onload.js:1
Injects the opt-in prompt. — src/optInHook/optInHook.js:1
Adds badges beside remotely classified search results when enabled. — src/content/serp-badge/serpBadge.js:1-108
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It monitors main-frame requests, redirects, headers, and errors and performs vendor, analytics, and configuration requests. It does not configure Chrome's proxy or intercept downloaded files.
Registers webRequest observers for all main-frame URLs and sends network-derived records to vendor and analytics endpoints. — src/background.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging or comparable system-control permission. — manifest.json:12-23
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Periodically fetches /pages/selections and /history/setup and activates configurations according to consent buckets. — src/background.js:1
Interprets downloaded selectors and operations against webpages. — src/onload.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Does not declare externally_connectable. — manifest.json:1-83
Uses runtime messaging for packaged scraper commands rather than accepting arbitrary page messages. — src/onload.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Checks optIn before upload, writes true only through ENABLE_OPT_IN, opens options on install, and removes buckets when declined. — src/background.js:1
Contains detailed consent, third-party sharing, and withdrawal language. — _locales/en/messages.json:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Declares scraper, navigation, and storage capabilities with no mining component. — manifest.json:1-83
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Implements table extraction and next-button clicking but no demonstrated form-action rewrite or silent credential redirection. — src/onload.js:1