Is Madgicx Plus - The SuperApp for Meta Advertisers safe?

Analysis summary

Madgicx Plus - The SuperApp for Meta Advertisers is designed to enhance advertising capabilities on Meta platforms. It is rated Medium risk due to its extensive permissions that could potentially expose sensitive data.

Key insights:

Intended to optimize advertising on Meta platforms.
Rated Medium due to broad host permissions and network interception capabilities.
Leverages permissions that allow interaction with all websites and network traffic modification.
Uses access in ways that could lead to cross-site surveillance and data exposure.
Low install count and individual publisher status raise concerns about reliability and accountability.

Findings

Removed from Marketplace

Flags items that have been removed or delisted from the marketplace, potentially due to security vulnerabilities, or malicious behavior. Such extensions pose a risk as they are no longer maintained or patched.

high

Network Interception Permissions

Flags items that request privileges enabling interception, observation, or modification of network traffic. Such capabilities can be used to monitor user activity, redirect requests, or interfere with external content, increasing the risk of surveillance, content manipulation, or traffic redirection.

medium

Broad Host Permissions

Flags items that declare overly broad host access patterns, enabling interaction with all websites. This level of access can be exploited to inject scripts into trusted sites and increases the risk of sensitive data exposure, cross-site surveillance, and credential harvesting.

medium

All findings are available for Enterprise users

Code analysis

AI-powered analysis of the extension's source code for security insights and risk assessment.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

CODE INSIGHTS ARE AVAILABLE FOR ENTERPRISE USERS

Permissions

high

declarativeNetRequest

api

Enables network request filtering using predefined rules without requiring direct access to request content.

high

declarativeNetRequestWithHostAccess

api

Allows network request filtering and modification using rules, but requires explicit host permissions for each site affected.

medium

storage

api

Enables persistent data storage for the extension, potentially storing large amounts of user-related information.

API Calls

API calls detected through static analysis of the source code. For more accurate insights, explore our sandbox dynamic analysis.

medium

chrome.runtime.connect

chrome

/background.iife.js

medium

chrome.runtime.id

chrome

/background.iife.js

medium

chrome.runtime.onMessage

chrome

/background.iife.js

All API calls are available for Enterprise users

Secrets

Any encoded/decoded secrets we managed to find in the source code, git repository, or related files

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

SECRETS ARE AVAILABLE FOR ENTERPRISE USERS

Vulnerabilities

Known vulnerabilities and security issues detected in the extension's dependencies and code.

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

VULNERABILITIES ARE AVAILABLE FOR ENTERPRISE USERS

External communication

Any identifiers we detected that may indicate external communication from the item's code

https://app.madgicx.com/svgCollections/default.collection.svg?v=1.2.0#icon-aim-welcome-avatar-blue

popup/assets/index-BFPICPHv.js

https://madgicx-plus.com/api/core/images?$

background.iife.js

https://madgicx-plus.com/api/core/polling/?$

background.iife.js

All external communications are available for Enterprise users

Dependencies

Dependencies and third-party libraries used by the extension, including version information and license details.

vue

Version:

3.5.12

All dependencies are available for Enterprise users

Licenses & Compliance

high

Enterprise Only

medium

Enterprise Only

low

Enterprise Only

LICENSES & COMPLIANCE ARE AVAILABLE FOR ENTERPRISE USERS