Is MyBib: Free Citation Generator safe?
We analyzed MyBib: Free Citation Generator version 1.2.10's actual code and gave it a 15/100 trust score. This extension has dangerous server-controlled…
Bottom line
This extension has dangerous server-controlled browser access that can quietly collect page data and use your browser for arbitrary network jobs.
What it can access
It can read complete pages across all websites, send page data elsewhere, and reach local services, far beyond citation needs.[Q1][Q3][Q6][Q19]
Security weaknesses
A persistent remote channel can direct arbitrary requests and hidden page visits without a user action, creating serious control and privacy weaknesses.[Q7][Q8][Q16][Q22]
Signs of misuse
The package enables quiet server-directed scraping and network work, including authenticated page content and potentially unlimited background use.[Q6][Q14][Q23]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has host access to every HTTP/HTTPS site plus tabs, scripting, storage, clipboard write, alarms, PDF handling, and an external connection from MyBib/localhost. These permissions enable complete page extraction, arbitrary requests, hidden tabs, and PDF capture.
Declares *://*/* host access, tabs, scripting, clipboardWrite, storage, alarms, PDF MIME handling, and externally_connectable origins. — manifest.json:1-57
Which websites can it run on, and can it read or change what appears on those pages?
It can read complete HTML and URLs from active or remotely opened pages. The reviewed code did not show it changing page content.
Injected hidden-tab functions return document.documentElement.outerHTML and navigation status only. — service_worker.js:1
Popup injection reads and returns page HTML/content type/URL without page mutation. — assets/index.d1f13f3d.js:5104-5105
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It can read the complete page of any accessible page. User-initiated citation sends up to 500 KB of the active page, while remote WebSocket jobs can copy the full HTML from server-selected pages, including authenticated content rendered through the user's session.
Popup executeScript returns document.documentElement.outerHTML, truncated to 500,000 characters, for upload. — assets/index.d1f13f3d.js:5104-5105
Remote useTab jobs inject a function returning the full outerHTML and send it over the WebSocket. — service_worker.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads the active tab URL for citation, searches for MyBib tabs, creates/removes remote-job tabs, and monitors tab updates/removals. It has no history permission, but has broad live-tab visibility and control.
Queries the active tab and reads its URL; save-to-project queries/updates MyBib tabs. — assets/index.d1f13f3d.js:5104-5105
Creates, gets, monitors, and removes tabs for remote jobs and PDF cache cleanup. — service_worker.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It writes generated citations to the clipboard and captures complete PDF response bodies for upload. It does not use camera, microphone, USB, Bluetooth, or native messaging.
Declares clipboardWrite and a PDF MIME handler. — manifest.json:24-38
Captures PDF stream contents up to 10,240,000 bytes into Cache Storage. — pdf-handler.js:1-63
Copies formatted citations via document.execCommand('copy'). — assets/index.d1f13f3d.js:5104-5105
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends active-page HTML, URLs, and PDFs to MyBib for citation generation. Separately, it sends response bodies or complete HTML from arbitrary server-directed requests and hidden tabs back over the MyBib WebSocket.
POSTs active-page HTML/URL/style to /api/autocite/html and requests PDF upload. — assets/index.d1f13f3d.js:5104-5105
Returns arbitrary Axios responses or remotely opened tab HTML to ws.mybib.com. — service_worker.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The background worker accepts URL, method, headers, data, and useTab instructions from ws.mybib.com and acts on them. The server therefore controls what the installed browser requests and scrapes.
WebSocket onmessage parses server JSON and passes it to Axios or uses its URL to create and scrape a browser tab. — service_worker.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The remote job channel starts automatically in the service worker, keeps the socket alive, and reconnects through alarms without any citation click or other user action.
Calls the connection routine at startup, sends 20-second keepalives, and schedules reconnect-alarm after closure or slow ping. — service_worker.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No browser-settings, search-provider, proxy, or override permissions are declared. — manifest.json:1-57
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
The 39 KB worker and 2.16 MB popup bundle are minified but retain readable behavior and endpoints. — inventory.json:1-end
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Webpack-style global-object helper returns globalThis first and only then contains new Function('return this') as a fallback. — service_worker.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Reads and uploads the active page URL/HTML during popup citation. — assets/index.d1f13f3d.js:5104-5105
Navigates server-selected URLs in hidden tabs and returns their contents. — service_worker.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
WebSocket and ping URLs include only the manifest version; no generated client ID or fingerprint payload is present. — service_worker.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
It does not copy raw cookies or passwords, but remote hidden tabs load through the user's browser session and then expose the rendered HTML. The arbitrary request client also enables credentials, so protected responses may be returned to MyBib.
Sets Axios withCredentials=true; remote jobs can navigate or request arbitrary sites and transmit response data/full DOM back to the server. — service_worker.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Injected function returns outerHTML only; no keyboard, input, media, or screen listeners are installed. — service_worker.js:1
Can a website or remote server send commands that make the extension take actions?
It contains a full remote-command channel. MyBib can direct arbitrary HTTP requests or hidden-tab navigations/scrapes, receive the results, and keep/reconnect the channel indefinitely.
Persistent ws.mybib.com WebSocket dispatches server messages into Axios or tabs.create plus scripting.executeScript and sends results back. — service_worker.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Visible UI generates and edits citations; no advertising or link-rewrite path was found. — assets/index.d1f13f3d.js:5104-5105
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, proxy, or request-blocking rules are declared. — manifest.json:1-57
Can it communicate with software on the computer or services running on localhost?
All-site access and server-controlled URLs allow requests and hidden-tab navigation to localhost and private-network web services, returning responses to MyBib. There is no native-messaging access.
Grants *://*/* host access and explicitly permits external connection from localhost. — manifest.json:31-44
Applies no protocol, hostname, localhost, or private-IP allowlist before executing remote jobs. — service_worker.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote responses are JSON-stringified and sent over the socket, never passed to eval, Function, importScripts, or script injection. — service_worker.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Externally connectable origins are restricted to localhost and www.mybib.com. — manifest.json:39-44
onMessageExternal accepts only action='version'. — service_worker.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Remote scraping happens in inactive pinned tabs that are automatically removed within about five seconds, making it easy for the behavior to occur without the user noticing. Reconnection is randomized after closure.
Remote useTab jobs create active:false pinned:true tabs, poll every 50 ms, return HTML, remove the tab, and enforce a five-second cleanup timer; reconnect delay is randomized. — service_worker.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
The operator can consume the user's bandwidth, browser, IP reputation, authenticated sessions, and network position for arbitrary proxy/scraping jobs. Jobs are server-controlled and have no client-side quota.
Persistent job socket accepts unlimited remote Axios or hidden-tab work and returns response data to the server. — service_worker.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Host-page injection only serializes outerHTML; form controls and mutations are confined to popup citation fields. — assets/index.d1f13f3d.js:5104-5105