Is Calculator Plus - Dark Mode & Keyboard safe?

Medium risk

Calculator Plus bundles the Mellowtel SDK, which loads server-chosen pages in hidden iframes after an opt-in.

The extension includes the Mellowtel SDK, which connects to Mellowtel servers and opens URLs they choose in hidden frames inside your browser. It modifies frame and cookie headers for those requests, records the requests and responses of those pages, and sends the rendered HTML to Mellowtel AWS endpoints. Activation depends on an opt-in page that opens on install.

v1.0.4Chrome Web Store
49Risk
Who publishes it

11 other listings from the same operator, 10 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

11 other listings published from this account, 2k+ users between them. 10 of them carry a finding.

Clock, Alarm, Timer & Stopwatch692MediumImage Downloader Assistant - Batch Save Images337MediumUndo Closed Tabs – Reopen Last Tab236MediumAlarm, Timer & Stopwatch for Browser230MediumQR Code Generator & Reader69MediumVideo Speed Controller - Universal Video Playback Speed59Medium5 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Calculator extension bundles an SDK that loads server-chosen pages in frames

Code analysis shows the bundled Mellowtel SDK can open server-chosen URLs in frames and record their XHR traffic, after an opt-in tab.

Activation depends on remote approval.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

Mellowtel's server approves the install and sends a URL to load.

This follows the opt-in flag being set in extension storage.

The extension did this

The extension loads that URL in a credentialless iframe and can record XHR traffic inside it.

Results go to a server-supplied api_endpoint.

The code that does this

The XHR hook that records requests and responses inside loaded frames

Readable version

meucci.js XHR open and post-back

meucci.js
XMLHttpRequest.prototype.open = function(e, s, r, i, o) {  this._requestInfo = {    id: f(),    burke_id: t.burke_id,    timestamp: (new Date).toISOString(),    url: s,    full_url: s.startsWith("http") ? s : window.location.origin + (s.startsWith("/") ? "" : "/") + s,    method: e,    async: !1 !== r,    user: i || null,    headers: {},    sentData: null,    responseData: null,    responseHeaders: null,    status: null,    statusText: null,    duration: null,    error: null  };  ...}function d(e) {  window.parent.postMessage({    isBurkeProcessed: !0,    recordID: e.id,    resultToSave: JSON.stringify(e),    apiEndpoint: t.api_endpoint,    type: "saveBurkeResult"  }, "*")}

background.js iframe creation

background.js
d.id = t, d.credentialless = !0,i && (d.setAttribute("sandbox", ""), "" !== s && d.setAttribute("sandbox", s)),"" !== r && d.setAttribute("data-id", r),d.src = e, d.onload = n
Fields the XHR hook records per request
  • Full URL
    https://example.com/api/v1/items?page=2

    Address of each XHR made inside the loaded frame.

  • Request headers
    {"Content-Type":"application/json"}

    Headers set through setRequestHeader on each call.

  • Sent data
    {"q":"shoes"}

    Request body passed to send().

  • Response body
    {"items":[{"id":4412}]}

    Response text and parsed JSON for text responses.

  • Response headers
    content-type: application/json

    Output of getAllResponseHeaders after load.

Endpoints named in the bundled SDK
    • ws.mellow.tel

    Websocket the SDK opens after approval; carries server instructions.

    • api.mellow.tel

    Approval endpoint polled before the websocket starts.

    • mjkrxoav2cqz3dtgn6ttcyxeua0mqpul.lambda-url.us-east-1.on.aws

    AWS Lambda URL that receives rendered page HTML from the SDK.

    • www.mellow.tel

    Opt-in page opened on install.

Check if you're affected

Searches an unpacked extension for the Mellowtel SDK markers cited in this finding.

find_mellowtel.sh · sh
#!/bin/sh# usage: ./find_mellowtel.sh /path/to/unpacked/extensioncd "$1" || exit 1grep -l 'ws.mellow.tel' *.jsgrep -l 'saveBurkeResult' *.jsgrep -l 'mellowtelOptIn' *.jsgrep -o 'credentialless' *.js | sort | uniq -c
How to run it
  1. 1Unpack the CRX.
  2. 2Run the script on the folder.
  3. 3Matches in background.js, meucci.js and pascoli.js indicate the SDK.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Calculator Plus - Dark Mode & Keyboard contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ws.mellow.tel

    Calculator Plus - Dark Mode & Keyboard sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.

  • api.mellow.tel

    Calculator Plus - Dark Mode & Keyboard sends data to api.mellow.tel. 13 other extensions we have analysed send data here.

  • mjkrxoav2cqz3dtgn6ttcyxeua0mqpul.lambda-url.us-east-1.on.aws

    Calculator Plus - Dark Mode & Keyboard sends data to mjkrxoav2cqz3dtgn6ttcyxeua0mqpul.lambda-url.us-east-1.on.aws. 2 other extensions we have analysed send data here.

  • 5xpb4fkh75h5s4vngnzy6oowcy0cgahe.lambda-url.us-east-1.on.aws

    Calculator Plus - Dark Mode & Keyboard sends data to 5xpb4fkh75h5s4vngnzy6oowcy0cgahe.lambda-url.us-east-1.on.aws. One other extension we have analysed sends data here.

Updated 15 October 2026bajijfddodanimeolonbjdaehmphfkpp