Is Cegid Peoplenet safe?

Question

Accepted Answer

Our review of Cegid Peoplenet surfaced the following. When the extension is installed or updated, it opens a help page (nativeinstall.html) in a new tab. That page's script auto-clicks a not-user-visible link that downloads m4clickoncehelper.exe — a 55 KB Windows .NET binary that was bundled inside the extension package. The on-page instructions then ask you to double-click the file to install the helper that the extension's native-messaging bridge requires. The download and the install request are part of the documented setup flow for ClickOnce support, but the binary itself ships inside the .crx with no integrity check beyond Chrome's signature on the extension as a whole. Anyone who can publish a new version under the same Chrome Web Store listing controls what the next .exe will be.

Is Cegid Peoplenet ClickOnce launcher safe?

Findings