Is 28 Days Habit Tracker safe?

Medium risk

28 Days Habit Tracker runs a bundled ZeroGPU compute SDK that registers your device with devices.zerogpu.ai by default.

The extension includes a ZeroGPU distributed-compute SDK that starts in a background offscreen page on install, with consent defaulting to opted-in. It registers the device with devices.zerogpu.ai and can load models to run remote workloads. The habit tracker popup does not mention this, and the only opt-out is on a zerogpu.ai-hosted settings page.

ZeroGPUv1.0.11Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Habit tracker runs a ZeroGPU compute SDK by default with no in-extension opt-out

Code analysis shows this habit tracker starts a bundled ZeroGPU SDK on install, with consent defaulting to opted-in.

The popup has no disclosure or setting for it.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You install a habit tracker that advertises only toolbar habit tracking.

The extension did this

It starts a distributed-compute SDK in a background page, opted in by default.

The popup contains no mention of it or a way to turn it off.

The code that does this

Consent defaults to opted-in

Readable version

Offscreen SDK initialisation

offscreen.js
import { initZeroGpuOffscreen } from "./vendor/zerogpu/zerogpu-offscreen.js";initZeroGpuOffscreen({  edgeOperatorKey: "zgpu-sdk-15246973c1b0b8f74b9f95c6a11b9489684ba03268cc2fbd90cfa9a38c03311a",  enableConsoleLogs: true,  customParams: {    cust_param1: chrome.runtime.id  }});

Orchestrator endpoint

vendor/zerogpu/zerogpu-offscreen.js
const ORCHESTRATOR_BASE_URL = typeof "https://devices.zerogpu.ai" === 'string' && "https://devices.zerogpu.ai".length > 0    ? "https://devices.zerogpu.ai"    : 'https://dev.devices.zerogpu.ai';
Manifest surface supporting the SDK
  • permissions
    ["storage", "offscreen"]

    Lets the extension create a background page that hosts the SDK.

  • optional_host_permissions
    https://*.zerogpu.ai/*, https://huggingface.co/*

    Lets the SDK request access to ZeroGPU and model-hosting sites.

  • externally_connectable
    matches: https://*.zerogpu.ai/*, ids: ["*"]

    Lets zerogpu.ai pages message the extension, including the settings page.

  • customParams.cust_param1
    angbpjelloieiidjjcedcnhamecflgel

    The extension's own ID is passed to the SDK as a custom parameter.

Hosts referenced by the bundled SDK
    • devices.zerogpu.ai

    Device registration endpoint configured in the SDK.

    • models.zerogpu.ai

    Model downloads referenced by the SDK.

    • huggingface.co

    Model hosting listed in optional host permissions.

Check if you're affected

Greps an unpacked copy of the extension for the default-on consent record and SDK initialisation.

Requires
  • POSIX shell
  • Unpacked extension directory
check_zerogpu_default.sh · sh
#!/bin/shDIR="$1"grep -n "optedIn: true" "$DIR/vendor/zerogpu/zerogpu-background.js"grep -n "initZeroGpuOffscreen" "$DIR/offscreen.js"grep -n "devices.zerogpu.ai" "$DIR/vendor/zerogpu/zerogpu-offscreen.js"grep -ci zerogpu "$DIR/popup.html" "$DIR/popup.js"
How to run it
  1. 1Unpack the CRX.
  2. 2Run sh check_zerogpu_default.sh <unpacked dir>.
  3. 3Expect hits in the first three greps and 0 in the popup files.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed 28 Days Habit Tracker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • devices.zerogpu.ai

    28 Days Habit Tracker sends data to devices.zerogpu.ai. No other extension we have analysed sends data here.

Updated 15 October 2026angbpjelloieiidjjcedcnhamecflgel