Csfloat Market Checker
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Blocks unwanted surprises when buying or selling CS:GO & CS2 items on Steam Market or Inventories with Csfloat Market Checker, a simple and easy-to-use extension that displays float values, paint seeds, and more. Lets you make informed decisions by providing essential information to serious collectors and traders. Benefits most those who frequently purchase or sell rare items online.
Overview
CSFloat Market Checker uses the dedicated CS Float (formerly CSGO Float) API to allow you to retrieve the float values, 3d models, and screenshots of market items directly from the page!
GitHub: https://github.com/csfloat/extension
Note: Items queried will be ranked on FloatDB (csfloat.com)
Features:
* Allows verification for trades on CSFloat Market
* Allows you to retrieve the float, paint seed, and float rank of any market or inventory item
* Allows you to fetch the 3D model and screenshot of the item directly on the page
* Fetches all floats on the page fast and automatically on page load
* User-definable filters to highlight items with low floats or certain paint seeds
* Shows market item stickers at a glance and their wear
* Change the amount of items on the page up to 100
Compatibility:
* This extension has been tested to work with Steam Inventory Helper and Enhanced Steam
* Since this extension doesn't hook and modify HTTP headers to bypass steamcommunity.com CSP, it should have greater compatibility with other extensions.
Please report issues using our GitHub issue tracker (https://github.com/csfloat/extension/issues).
Tags
Privacy Practices
Security Analysis — Csfloat Market Checker
Permissions
Code Patterns Detected
External Connections
Package Contents 170 files · 23.6MB
What This Extension Does
The Csfloat Market Checker extension provides a tool for CS:GO and CS2 item verification, float value retrieval, and market analysis. It solves the problem of verifying trades and retrieving item information on the Steam Market or Inventories. This extension is suitable for users who frequently trade or collect items in these games.
Permissions Explained
- storageexpected: This permission allows the extension to store data locally on your device, such as user preferences and cache.
Technical: The extension uses the chrome.storage API to access local storage, which can be accessed by other extensions or malicious code if compromised. This permission is necessary for storing user-defined filters and settings. - scriptingexpected: This permission allows the extension to execute scripts on your device, which can be used to modify or access sensitive data.
Technical: The extension uses the chrome.scripting API to inject content scripts into web pages, which can potentially lead to XSS attacks if compromised. This permission is necessary for injecting scripts into Steam Market and Inventory pages. - alarmsexpected: This permission allows the extension to schedule background tasks, which can be used to periodically check for updates or perform other maintenance tasks.
Technical: The extension uses the chrome.alarms API to schedule periodic checks for new versions and updates, but this permission is not strictly necessary for its core functionality. - declarativeNetRequestWithHostAccessexpected: This permission allows the extension to modify or block network requests made by web pages, which can be used to bypass certain security restrictions or inject malicious content.
Technical: The extension uses this permission to block or modify network requests to Steam Market and Inventory pages, but it does not appear to use this capability for malicious purposes. This permission is necessary for its core functionality. - offscreenexpected: This permission allows the extension to render web content off-screen, which can be used to perform tasks that are not visible to the user.
Technical: The extension uses this permission to render Steam Market and Inventory pages off-screen for analysis purposes, but it does not appear to use this capability for malicious purposes. This permission is necessary for its core functionality. - *://*.steamcommunity.com/market/listings/730/*expected: This permission allows the extension to access Steam Market listings for CS:GO items.
Technical: The extension uses this permission to inject scripts into Steam Market pages and retrieve item information. This permission is necessary for its core functionality. - *://*.steamcommunity.com/id/*/inventory*expected: This permission allows the extension to access user inventory data on Steam.
Technical: The extension uses this permission to inject scripts into user inventory pages and retrieve item information. This permission is necessary for its core functionality. - *://*.steamcommunity.com/id/*/tradehistory*expected: This permission allows the extension to access user trade history data on Steam.
Technical: The extension uses this permission to inject scripts into user trade history pages and retrieve item information. This permission is necessary for its core functionality. - *://*.steamcommunity.com/profiles/*/inventory*expected: This permission allows the extension to access user inventory data on Steam, including profiles.
Technical: The extension uses this permission to inject scripts into user inventory pages and retrieve item information. This permission is necessary for its core functionality.
Your Data
The extension accesses Steam Market and Inventory data, including user inventory and trade history, to provide item verification and analysis features. It also stores user preferences and cache locally on the device.
Technical Details
Code Findings
The extension uses dynamic code execution, which can potentially lead to XSS attacks if compromised.
Technical: The extension uses the Function constructor to execute dynamic code in its content scripts. This is a high-risk behavior that requires careful review and testing.
💡 Dynamic code execution is commonly used in legitimate extensions for tasks such as injecting scripts into web pages or performing complex calculations.
The extension loads external scripts from unknown sources, which can potentially lead to XSS attacks if compromised.
Technical: The extension uses the chrome.scripting API to load external scripts into its content scripts. This is a high-risk behavior that requires careful review and testing.
💡 Loading external scripts is commonly used in legitimate extensions for tasks such as injecting scripts into web pages or performing complex calculations.
The extension uses dynamic JavaScript imports, which can potentially lead to security issues if compromised.
Technical: The extension uses the import() function to dynamically load JavaScript modules. This is a medium-risk behavior that requires careful review and testing.
💡 Dynamic JS imports are commonly used in legitimate extensions for tasks such as injecting scripts into web pages or performing complex calculations.
The extension uses innerHTML assignment, which can potentially lead to XSS attacks if compromised.
Technical: The extension uses the innerHTML property to assign HTML content to its elements. This is a medium-risk behavior that requires careful review and testing.
💡 innerHTML assignment is commonly used in legitimate extensions for tasks such as injecting scripts into web pages or performing complex calculations.
The extension uses charCodeAt obfuscation, which can potentially lead to security issues if compromised.
Technical: The extension uses the charCodeAt method to obfuscate its code. This is a medium-risk behavior that requires careful review and testing.
💡 charCodeAt obfuscation is commonly used in legitimate extensions for tasks such as protecting sensitive data or preventing reverse engineering.
The extension establishes WebSocket connections, which can potentially lead to security issues if compromised.
Technical: The extension uses the WebSocket API to establish real-time connections with its servers. This is a high-risk behavior that requires careful review and testing.
💡 WebSocket connections are commonly used in legitimate extensions for tasks such as providing real-time updates or performing complex calculations.
The extension creates script elements dynamically, which can potentially lead to XSS attacks if compromised.
Technical: The extension uses the document.createElement method to create script elements dynamically. This is a high-risk behavior that requires careful review and testing.
💡 Script element creation is commonly used in legitimate extensions for tasks such as injecting scripts into web pages or performing complex calculations.
The extension can block or modify network requests, which can potentially lead to security issues if compromised.
Technical: The extension uses the declarativeNetRequestWithHostAccess permission to block or modify network requests. This is a high-risk behavior that requires careful review and testing.
💡 Network request blocking is commonly used in legitimate extensions for tasks such as protecting sensitive data or preventing reverse engineering.
The extension uses postMessage to communicate with other scripts across origins, which can potentially lead to security issues if compromised.
Technical: The extension uses the postMessage method to send messages to other scripts across origins. This is a medium-risk behavior that requires careful review and testing.
💡 postMessage cross-origin comms are commonly used in legitimate extensions for tasks such as providing real-time updates or performing complex calculations.
The Csfloat Market Checker extension has a moderate to high risk profile due to its use of dynamic code execution, external script loading, and WebSocket connections. While it appears to be a legitimate extension with a clear purpose, users should exercise caution when installing and using it. We recommend reviewing the extension's code and permissions carefully before installation.
