PearPass

The extension uses techniques to hide its code, making it harder for average users or security researchers to inspect what the software is actually doing.

Technical: Analysis detected usage of String.fromCharCode and charCodeAt patterns. These are commonly used to encode strings into Unicode escape sequences (e.g., '\u0041') to bypass simple static analysis tools and hide logic from casual inspection.

💡 Developers often obfuscate code to protect intellectual property or prevent easy reverse-engineering of their algorithms.

The extension creates and runs new scripts on web pages dynamically. This can be used to inject malicious code if the extension itself is compromised.

Technical: Code behavior indicates dynamic creation of <script> elements. This bypasses standard CSP restrictions that block inline scripts, allowing the extension to execute arbitrary JavaScript in the context of any visited page.

💡 Used for injecting UI overlays or modifying DOM elements to enhance user experience.

The extension has the ability to capture keystrokes. While necessary for a password manager, this is the highest risk feature if the code is tampered with.

Technical: Behavioral analysis indicates 'Captures keystrokes'. In a legitimate password manager, this is used to detect when a user types a password so it can be saved or masked. However, combined with clipboardRead and dynamic script injection, this creates a potent vector for keylogging if the nativeMessaging host is compromised.

💡 Essential for auto-filling passwords and detecting active typing sessions.

The code might contain hidden secrets or API keys that are visible if someone inspects the source files.

Technical: Static analysis flagged 'Potential hardcoded secret'. This could be an internal API key, a debug token, or a signing key embedded directly in the JavaScript bundle.

💡 Sometimes used for internal debugging or connecting to staging environments.

The extension does not enforce strict security rules on which scripts can run, making it more vulnerable to attacks from malicious websites.

Technical: Manifest inspection shows 'Content Security Policy: not set'. Without a CSP header or manifest setting, the browser allows any script loaded by the page (including those injected by the extension) to execute.

💡 Extensions often omit CSP for simplicity or because they rely on dynamic injection which conflicts with strict CSPs.

The extension connects to many unrelated websites like Slack, Google Docs, and React documentation sites.

Technical: Network activity logs show requests to hooks.slack.com, docs.google.com, react.dev, etc. These are likely used for fetching library dependencies (e.g., Redux Toolkit) or updating internal documentation links, but the lack of a specific manifest scope for these domains is unusual.

💡 Fetching external libraries or checking for updates from official repositories.