Is Адаптер Рутокен Плагин safe?

Rutoken Plugin Adapter bridges every visited page to a native Rutoken hardware token host via a postMessage relay with no origin restriction.

The extension injects a JavaScript SDK into all pages and listens for postMessage events from page scripts, relaying them to the native host ru.rutoken.firewyrmhost. The runtime extension ID used to authenticate these messages is exposed in discoverable window globals injected by the content script itself, meaning any script on any page can establish a bridge to the native host. No origin allowlist limits which sites may invoke the relay.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.