Is 3DOS Network safe?
3DOS Network is medium risk. When 3DOS starts, it fetches a JSON domain list from a public GitHub repo under 3dos-labs. The list decides if the content script collects full page text. The owner can update it anytime, changing collected sites, without a new version.
Who publishes it3DOS INC - no other listings under this identity
3DOS INC - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote GitHub list controls which sites are excluded from page-text collection
When 3DOS starts, it fetches a JSON domain list from a public GitHub repo under 3dos-labs.
The list decides if the content script collects full page text.
The owner can update it anytime, changing collected sites, without a new version.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You install or restart your browser with the 3DOS extension enabled.
No interaction is needed, the fetch fires automatically during service worker initialisation.
The extension downloads a domain list from GitHub and stores it to control which sites it collects page text from.
The list is held in chrome.storage.local and consulted by the content script on every page load.
HTTP 200. JSON object with a whiteList array of e-commerce and partner domain names (amazon.com, taobao.com, ebay.com, …). Four matching requests were captured in dynamic analysis, two from the service worker and two from the content script.
- Accept
- */*
Fetch and store the remote domain list (background/index.js lines 953-958, 2570-2574)
// Called on service-worker startup (line 2570) and again if the stored list is empty (line 2573)function fetchRemoteDomainList(callback) { fetch(URLS.FETCH_WHITELISTED_DOMAINS) // https://raw.githubusercontent.com/3dos-labs/whitelist/…/whiteList.json .then(res => res.json()) .then(data => { callback(data.whiteList); }) // array of domain strings .catch(err => { console.error('Error fetching blacklisted domains:', err); });}// On startup (line 2570):fetchRemoteDomainList(list => { localList = list; storage.set('blacklistedDomains', list); // written to chrome.storage.local});Content script gate: skips page-text collection when hostname is listed (contentUI/index.js:94-113)
function collectPageText() { chrome.storage.local.get('blacklistedDomains', ({ blacklistedDomains: list }) => { const url = new URL(window.location.href); const hostname = url.hostname; if (!isAllowed(list || [], hostname)) { // hostname is in the remote-controlled exclusion list — skip collection return; } if (document.body.innerText.length === 0) return; const regionData = { language: document.documentElement.lang, country: document.documentElement.getAttribute('lang'), }; const payload = { text: document.body.innerText, regionalData: regionData, url }; sendDataToBackground(payload); // forwards to API via chrome.runtime.sendMessage });}- raw.githubusercontent.com
Serves 3dos-labs/whitelist's whiteList.json, a domain array used as a remote kill-switch for page-text collection. Controlled by whoever has write access to the repo.
What it can do
Permissions this extension asks for, as declared in version 0.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Schedule its own background tasks
alarms