Is CFCA CryptoKit.BOYSH Extension safe?

CFCA CryptoKit.BOYSH Extension connects any trusted page to any native-messaging host on the machine and relays its messages unchecked.

The extension listens for messages from any page matching its externally_connectable rules, which include any site on http://localhost regardless of port, along with Hamagin.com.cn and 120.133.60.99. It takes a host name straight from that page and hands it unchecked to Chrome's native messaging API, so the page can pick any native messaging host installed on the machine, not just CFCA's own bridge. It then forwards the page's raw message payload to whichever host got connected and relays that host's replies back.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.