Is E-commerce Product Research & Image Search Tool safe?
We analyzed E-commerce Product Research & Image Search Tool version 1.1.1's actual code and gave it a 78/100 trust score. This appears purpose-aligned but…
Bottom line
This appears purpose-aligned but has broad always-on page access and sends selected image and page links to its own service.
What it can access
It runs on every website and inspects nearby image links automatically, which is broader than needed but fits image search.[Q1][Q2]
Security weaknesses
No remote code execution, website-controlled commands, or exposed privileged messaging was found.[Q7][Q11][Q16][Q21]
Signs of misuse
It sends a chosen image link and current page link to Diffshop after image search, with no evidence of hidden tracking or sensitive-data collection.[Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
Two packaged page access run on all HTTP and HTTPS pages. Permissions also include tabs, activeTab and scripting.
Declares the permissions and injects contentInjected/index.js plus contentUI/index.js on all URLs. — manifest.json:9-16,37-60
Which websites can it run on, and can it read or change what appears on those pages?
An always-on mouseover listener examines hovered and nearby elements for image sources or CSS background-image URLs. It does not read page text or form values.
The capture-phase mouseover handler traverses nearby DOM nodes, checks IMG src and computed backgroundImage, then reports the image URL to the background worker. — assets/js/root.EU72iatI.js:1
Loads that code on every webpage. — manifest.json:37-60
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads tag names, image src, computed background images, display state and selector structure; no input value or text-content read appears. — assets/js/root.EU72iatI.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests tabs but not history, bookmarks, downloads or browsingData. — manifest.json:9-16
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares no device, geolocation, clipboard or capture permission. — manifest.json:9-16
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
After the user selects Image Search, the extension opens Diffshop with the chosen image URL and current page URL in the destination URL. Installation also opens the Diffshop homepage.
The context-menu click handler builds /image-search-software?url=<image>&source=<page URL> and opens it; onInstalled opens the localized Diffshop homepage. — src/pages/background/index.js:1
Defines the English homepage destination as https://www.diffshop.com. — _locales/en/messages.json:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Uses fixed packaged destinations as browser navigations and never reads their responses. — src/pages/background/index.js:1
All hover and page integration behavior is packaged locally. — assets/js/root.EU72iatI.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Page injection and hover inspection start automatically on every webpage. Data leaves the extension only after an explicit image-search click; installation also opens the vendor site automatically.
Automatically loads both content scripts on all URLs. — manifest.json:37-60
Registers the mouseover listener immediately. — assets/js/root.EU72iatI.js:1
Transmission is reached through contextMenus.onClicked; onInstalled opens the homepage. — src/pages/background/index.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, privacy, management or search-provider permission. — manifest.json:9-16
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
First-party scripts are bundled and minified into single lines, but their data flow and fixed destinations remain inspectable. No encrypted data was found.
Single-line bundled content implementation remains directly readable. — assets/js/root.EU72iatI.js:1
Single-line worker includes a large standard webextension polyfill plus a short visible application tail. — src/pages/background/index.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
The apparent Function reference is Function.call.bind(Object.prototype.hasOwnProperty); it never compiles a string. — src/pages/background/index.js:1
All executable files were included in the dynamic-code search. — inventory.json:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads the context-menu tab's url and appends it as the source parameter only inside the image-search click handler. — src/pages/background/index.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Generic storage helper persists named UI state only; it creates no identifier. — assets/js/base.vKkdtB2A.js:1
No telemetry or identifier is included in the Diffshop navigation. — src/pages/background/index.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies permission. — manifest.json:9-16
Content logic does not read document.cookie or authentication data. — assets/js/root.EU72iatI.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Registers mouseover and click behavior only; it does not access input values or capture pixels. — assets/js/root.EU72iatI.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Remote URLs are navigation sinks; there is no fetch, response parser or command handler. — src/pages/background/index.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates #diffshop-chrome-extension-content-view-root, an open shadow root and fixed packaged style text. — assets/js/root.EU72iatI.js:1
On Clear Cache click, executes a literal packaged function that removes search-image-disable-selector-diffshop. — src/pages/popup/index.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, downloads or proxy permission. — manifest.json:9-16
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or file-system permission. — manifest.json:9-16
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Loads only packaged background and content scripts. — manifest.json:23-25,37-60
Opens remote pages but never reads or executes their responses. — src/pages/background/index.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Dispatches service-plugin-dock-event with fixed register/diffshop detail and has no corresponding page-event listener. — assets/js/root.EU72iatI.js:1
Contains no externally_connectable declaration. — manifest.json:1-76
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Defines state-search-storage-key with show/hide values. — assets/js/twind.Fkectbzh.js:1
Calls the storage hook but ignores its returned value before always registering the mouseover listener. — assets/js/root.EU72iatI.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background page work is limited to shallow DOM traversal during mouseover. — assets/js/root.EU72iatI.js:1
Worker handles context menus, installation and local messages only. — src/pages/background/index.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
DOM traversal looks only for IMG elements and CSS background-image URLs; no form APIs or values appear. — assets/js/root.EU72iatI.js:1