Is AI Code Finder, Alerts, Ask Questions about Papers: CatalyzeX safe?

Medium risk

CatalyzeX sends page URLs, paper titles, and arxiv IDs to its servers on every academic page visit, and links this activity to authenticated user accounts via Mixpanel.

When a user visits academic search results on Google Scholar or similar sites, the extension transmits the current page URL, paper title, and arxiv ID to catalyzex.com to look up associated code repositories. It also sends behavioral events to a Mixpanel analytics endpoint proxied through catalyzex.com, recording every code lookup, click, and page visit. If the user is logged in to CatalyzeX, all tracking events are attributed to their account identity via a stored user ID.

gragtahv0.0.0.122Chrome Web Store
49Risk
Who publishes it

Profillic, Inc. - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
gragtah
Declared legal entity
Profillic, Inc.
Registered address
32 Heron St, San Francisco, CA 94103-4511, US
Registered contact
CatalyzeX

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

catalyzex.com
Also called by 2 other listings, including Scholar Utility Belt

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Mixpanel analytics sends page URLs and paper metadata to CatalyzeX

Dynamic analysis captured POSTs from CatalyzeX to catalyzex.com/mp/track, the vendor's Mixpanel proxy, with each page's URL plus paper titles and ArXiv IDs.

Events fire on interactions (lookups, alert clicks, author questions), no opt-out.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You visit an ArXiv, Google Scholar, or Google Search page and interact with the extension, clicking a code link, setting an alert, or asking an author a question.

The extension's content script runs on all URLs matching the manifest's content_scripts.matches list, which includes arxiv.org, scholar.google.com, and dozens of Google regional domains.

The extension did this

The extension records the event type and attaches the page URL, paper title, and ArXiv ID, then transmits this to www.catalyzex.com/mp/track via the Mixpanel SDK.

The tE wrapper calls mixpanel.track with an event name and a properties object that always includes embed_url (window.location.href) and paper metadata fields. The SDK batches events and flushes them to the vendor's own /mp proxy.

Captured request
POSThttps://www.catalyzex.com/mp/track/

HTTP 200. Event delivery confirmed. Decoded body includes event='Code Lookup', embed_url='https://arxiv.org/abs/1812.04948', paper_title='A Style-Based Generator Architecture for Generative Adversarial Networks', arxiv_id='1812.04948', token='851392464b60e8cc1948a193642f793b'. Captured in dynamic analysis, captured during dynamic analysis.

Headers
Content-Type
application/x-www-form-urlencoded
Body
data=W3siZXZlbnQiOiJDb2RlIExvb2t1cCIsInByb3BlcnRpZXMiOnsiZW1iZWRfdXJsIjoiaHR0cHM6Ly9hcnhpdi5vcmcvYWJzLzE4MTIuMDQ5NDgiLCJwYXBlcl90aXRsZSI6IkEgU3R5bGUtQmFzZWQgR2VuZXJhdG9yIEFyY2hpdGVjdHVyZSBmb3IgR2VuZXJhdGl2ZSBBZHZlcnNhcmlhbCBOZXR3b3JrcyIsImFyeGl2X2lkIjoiMTgxMi4wNDk0OCIsInRva2VuIjoiODUxMzkyNDY0YjYwZThjYzE5NDhhMTkzNjQyZjc5M2IifX1d
Fields sent in each Mixpanel event
  • Page URL
    https://arxiv.org/abs/1812.04948

    The full address of the research page you were viewing when the event fired.

  • Paper title
    A Style-Based Generator Architecture for Generative Adversarial Networks

    The title of the academic paper displayed on the current page.

  • ArXiv ID
    1812.04948

    The canonical ArXiv paper identifier linked to the page you visited.

  • CatalyzeX user ID
    49271

    If you are signed into CatalyzeX, your numeric account ID is included, linking the event to your account.

  • Event name
    Code Lookup

    Interaction type recorded: Code Lookup, Code Click, Alert Click, Ask Author, See All, Notebook Click, Add Code, or Bookmark Click.

The code that does this

Mixpanel initialization and event tracking wrapper (extension.js:1351)

Readable version
// Initialize Mixpanel with vendor's own proxy at catalyzex.com/mpmixpanel.init("851392464b60e8cc1948a193642f793b", { loaded:  => { chrome.runtime.sendMessage({ type: "getUserId" }); if (!tp) mixpanel.set_config({ ignore_dnt: true }); // ignores Do Not Track }, api_host: `${catalyzeXBaseUrl}/mp` // routes via catalyzex.com/mp, not mixpanel.com});// Wrapper that attaches CatalyzeX user ID when signed inconst tE = (eventName, props = {}) => { try { props.extension = true; const userId = localStorage.getItem("@cx/userId"); if (userId) props.$user_id = parseInt(userId); // links to CatalyzeX account mixpanel.track(eventName, props); } catch {}};
Where this data is sent
    • www.catalyzex.com

    Developer's own server. Hosts a Mixpanel proxy at /mp/track/ receiving all analytics events, including page URLs, paper titles, ArXiv IDs, and user account IDs.

Page URL and paper title sent to CatalyzeX on every paper page visit

Dynamic analysis captured GETs from CatalyzeX to catalyzex.com/api/code with the full URL of every paper page visited, plus title and ArXiv ID.

These fire on page load per paper, and the response includes author contact availability.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open any academic paper page that the extension recognizes, on ArXiv, Google Scholar, IEEE, ACL, and dozens of other supported sites.

The extension's content script runs on every page matching its manifest scope. The r0 function is called for each detected paper node and fires a network request unconditionally.

The extension did this

The extension immediately issues a GET request to www.catalyzex.com/api/code with the paper's ArXiv ID, title, and the full URL of the page you are viewing.

The request uses XMLHttpRequest with the paper metadata URL-encoded as query parameters. This happens on every paper page load, not on user interaction; there is no button to click.

Captured request
GEThttps://www.catalyzex.com/api/code?extension=true&paper_arxiv_id=1812.04948&paper_title=A%20Style-Based%20Generator%20Architecture%20for%20Generative%20Adversarial%20Networks&paper_url=https%3A%2F%2Farxiv.org%2Fabs%2F1812.04948

HTTP 200. Response JSON includes code_url='https://github.com/NVlabs/stylegan', cx_url, arxiv_id, and author_email_available, confirming paper lookup succeeded. Captured in dynamic analysis, captured during dynamic analysis.

Headers
Content-Type
application/json
Access-Control-Allow-Origin
*
Query parameters sent on every paper page visit
  • Paper page URL
    https://arxiv.org/abs/1812.04948

    The full address of the paper page you are currently viewing, reveals which specific papers you read and when.

  • Paper title
    A Style-Based Generator Architecture for Generative Adversarial Networks

    The full title of the paper on the current page.

  • ArXiv ID
    1812.04948

    The canonical identifier for the paper, included when an ArXiv ID can be extracted from the URL.

The code that does this

Code lookup request construction in r0 (extension.js:1766)

Readable version
// Build the API URL with paper metadata as query parameterslet apiUrl = "https://www.catalyzex.com/api/code?extension=true";// On certain pages, also check whether the author has contact detailsif (t6(currentUrl)) apiUrl += "&check_author_contact=true";if (arxivId != null) apiUrl += "&paper_arxiv_id=" + encodeURIComponent(arxivId);if (paperTitle != null) apiUrl += "&paper_title=" + encodeURIComponent(paperTitle);if (paperUrl != null) apiUrl += "&paper_url=" + encodeURIComponent(paperUrl);xhr.open("GET", apiUrl, true); // fires on every detected paper node, not on user click
Where this data is sent
    • www.catalyzex.com

    Developer's server. Receives paper URL, title, and ArXiv ID per page visit. Returns code links and author contact availability, logging the user's paper browsing.

What it can do

Permissions this extension asks for, as declared in version 0.0.0.122. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on arxiv.org

    https://arxiv.org/*

  • Read and change your data on twitter.com

    https://twitter.com/*

  • Read and change your data on www.google.com

    https://www.google.com/*

  • Read and change your data on www.google.co.uk

    https://www.google.co.uk/*

  • Read and change your data on www.google.co.in

    https://www.google.co.in/*

  • Read and change your data on www.google.co.il

    https://www.google.co.il/*

  • Read and change your data on www.google.co.kr

    https://www.google.co.kr/*

  • Read and change your data on www.google.co.jp

    https://www.google.co.jp/*

  • Read and change your data on www.google.co.th

    https://www.google.co.th/*

  • Read and change your data on www.google.co.ma

    https://www.google.co.ma/*

  • Read and change your data on www.google.co.nz

    https://www.google.co.nz/*

  • Read and change your data on www.google.com.br

    https://www.google.com.br/*

  • Read and change your data on www.google.com.vn

    https://www.google.com.vn/*

  • Read and change your data on www.google.com.tw

    https://www.google.com.tw/*

  • Read and change your data on www.google.com.au

    https://www.google.com.au/*

  • Read and change your data on www.google.com.sg

    https://www.google.com.sg/*

  • Read and change your data on www.google.com.tr

    https://www.google.com.tr/*

  • Read and change your data on www.google.com.eg

    https://www.google.com.eg/*

  • Read and change your data on www.google.com.hk

    https://www.google.com.hk/*

  • Read and change your data on www.google.com.bd

    https://www.google.com.bd/*

  • Read and change your data on www.google.com.pk

    https://www.google.com.pk/*

  • Read and change your data on www.google.com.pe

    https://www.google.com.pe/*

  • Read and change your data on www.google.com.ar

    https://www.google.com.ar/*

  • Read and change your data on www.google.com.ph

    https://www.google.com.ph/*

  • Read and change your data on www.google.fr

    https://www.google.fr/*

  • Read and change your data on www.google.de

    https://www.google.de/*

  • Read and change your data on www.google.ca

    https://www.google.ca/*

  • Read and change your data on www.google.it

    https://www.google.it/*

  • Read and change your data on www.google.sc

    https://www.google.sc/*

  • Read and change your data on www.google.es

    https://www.google.es/*

  • Read and change your data on www.google.ru

    https://www.google.ru/*

  • Read and change your data on www.google.at

    https://www.google.at/*

  • Read and change your data on www.google.cz

    https://www.google.cz/*

  • Read and change your data on www.google.pt

    https://www.google.pt/*

  • Read and change your data on www.google.ch

    https://www.google.ch/*

  • Read and change your data on www.google.tn

    https://www.google.tn/*

  • Read and change your data on www.google.dz

    https://www.google.dz/*

  • Read and change your data on www.google.lk

    https://www.google.lk/*

  • Read and change your data on www.google.pl

    https://www.google.pl/*

  • Read and change your data on scholar.google.com

    https://scholar.google.com/*

  • Read and change your data on scholar.google.co.uk

    https://scholar.google.co.uk/*

  • Read and change your data on scholar.google.co.in

    https://scholar.google.co.in/*

  • Read and change your data on scholar.google.co.il

    https://scholar.google.co.il/*

  • Read and change your data on scholar.google.co.kr

    https://scholar.google.co.kr/*

  • Read and change your data on scholar.google.co.jp

    https://scholar.google.co.jp/*

  • Read and change your data on scholar.google.co.th

    https://scholar.google.co.th/*

  • Read and change your data on scholar.google.co.nz

    https://scholar.google.co.nz/*

  • Read and change your data on scholar.google.com.br

    https://scholar.google.com.br/*

  • Read and change your data on scholar.google.com.vn

    https://scholar.google.com.vn/*

  • Read and change your data on scholar.google.com.tw

    https://scholar.google.com.tw/*

  • Read and change your data on scholar.google.com.au

    https://scholar.google.com.au/*

  • Read and change your data on scholar.google.com.sg

    https://scholar.google.com.sg/*

  • Read and change your data on scholar.google.com.tr

    https://scholar.google.com.tr/*

  • Read and change your data on scholar.google.com.eg

    https://scholar.google.com.eg/*

  • Read and change your data on scholar.google.com.hk

    https://scholar.google.com.hk/*

  • Read and change your data on scholar.google.com.bd

    https://scholar.google.com.bd/*

  • Read and change your data on scholar.google.com.pk

    https://scholar.google.com.pk/*

  • Read and change your data on scholar.google.com.pe

    https://scholar.google.com.pe/*

  • Read and change your data on scholar.google.com.ar

    https://scholar.google.com.ar/*

  • Read and change your data on scholar.google.com.ph

    https://scholar.google.com.ph/*

  • Read and change your data on scholar.google.fr

    https://scholar.google.fr/*

  • Read and change your data on scholar.google.de

    https://scholar.google.de/*

  • Read and change your data on scholar.google.ca

    https://scholar.google.ca/*

  • Read and change your data on scholar.google.it

    https://scholar.google.it/*

  • Read and change your data on scholar.google.sc

    https://scholar.google.sc/*

  • Read and change your data on scholar.google.es

    https://scholar.google.es/*

  • Read and change your data on scholar.google.ru

    https://scholar.google.ru/*

  • Read and change your data on scholar.google.at

    https://scholar.google.at/*

  • Read and change your data on scholar.google.cz

    https://scholar.google.cz/*

  • Read and change your data on scholar.google.pt

    https://scholar.google.pt/*

  • Read and change your data on scholar.google.ch

    https://scholar.google.ch/*

  • Read and change your data on scholar.google.pl

    https://scholar.google.pl/*

  • Read and change your data on catalyzex.com

    https://*.catalyzex.com/*

  • Add items to the right-click menu

    contextMenus

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed CatalyzeX contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.catalyzex.com

    CatalyzeX sends data to www.catalyzex.com. 2 other extensions we have analysed send data here.

Updated 30 September 2026aikkeehnlfpamidigaffhfmgbkdeheil