Is Conch AI safe?
Conch AI is medium risk. Conch AI listens for text selection everywhere. Selecting text sends it to the extension UI, tracking a Mixpanel event via conch-user-inf-a77wo.ondigitalocean.app with stored email. DA confirmed Mixpanel was live; the body wasn't captured.…
Who publishes itYofi Tech, LLC - no other listings under this identity
Yofi Tech, LLC - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Selected text is sent to Mixpanel with your email
Conch AI listens for text selection everywhere.
Selecting text sends it to the extension UI, tracking a Mixpanel event via conch-user-inf-a77wo.ondigitalocean.app with stored email.
DA confirmed Mixpanel was live; the body wasn't captured.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You select text on a webpage.
The listener runs after a mouseup event and ignores only empty selections.
The extension forwards that selected text into a Mixpanel analytics event.
The event wrapper also adds the email stored in the extension's local browser storage.
- Selected textMeeting notes: renew vendor contract by Friday (illustrative)
Text you highlight can include page content or text you typed into a form before selecting it.
- Email identifieralex.rivera@example.co (illustrative)
Your selected text can be associated with the email address stored by the extension.
- Network address203.0.113.42 (illustrative)
The Mixpanel client is configured to include network-address context with analytics requests.
Dynamic analysis observed the Mixpanel setup as live; the selected-text event body was not captured.
The listener, analytics wrapper, and message handler
Content script reads the selected text
assets/content.js-CT05Gyqb.jsdocument.addEventListener("mouseup", () => { const e = window.getSelection().toString().trim(); e && chrome.runtime.sendMessage({ type: "TEXT_SELECTED", text: e })});Analytics wrapper adds the stored email
assets/index.html-D-JuFirD.jsZ = (e, t) => { Sv.track("New Extension: " + e, { email: (localStorage == null ? void 0 : localStorage.getItem("email")) || "", ...t })}Popup initializes Mixpanel and handles TEXT_SELECTED
assets/index.html-D-JuFirD.jsfunction mO() { const { tab: e, onTabChange: t } = os(), { user: n, isLoading: r } = Ae(), i = o => { t(o) }; return R.useEffect(() => { const o = window.chrome; Sv.init(gk, { debug: !0, ignore_dnt: !0, api_host: "https://conch-user-inf-a77wo.ondigitalocean.app", persistence: "localStorage", ip: !0 }), o.storage.local.get("conchData", async s => { const { conchData: a } = s || {}; a && (Ae.setState({ user: a.user, email: a.email, accessToken: a.accessToken, userId: a.userId }), localStorage.setItem(ce.USER_ID, a.userId), localStorage.setItem(ce.EMAIL, a.email), localStorage.setItem(ce.ACCESS_TOKEN, a.accessToken), Z("Extension Launched", { email: a.email, userId: a.userId })) }), o.runtime.onMessage.addListener(s => { s.type === "OPEN_AI_COMMANDS" && (t("ai-commands"), Z("Open AI Commands Menu")), s.type === "TEXT_SELECTED" && (fe.setState({ text: s.text }), Z("Text Selected", { text: s.text })), s.type === "PAGE_CONTENT" && (fe.setState({ pageContent: s.content }), Z("Page Content", { content: s.content })), s.type === "PAGE_TITLE_AND_URL" && (fe.setState({ pageTitle: s.title, pageUrl: s.url }), Z("Page Title and URL", { title: s.title, url: s.url })) }) }, []), r ? w.jsx(El, {}) : !n && !r ? w.jsx(wk, {}) : w.jsxs("div", { className: "h-screen w-full gap-3 flex items-center justify-start m-0 p-0 bg-primary", children: [w.jsx(LE, { toastOptions: { className: "bg-secondary text-white text-xs p-1", icon: null }, position: "top-right" }), w.jsx(Mk, {}), w.jsx(MR, { children: e ? hO[e] : w.jsx(sO, { onTabChange: i }) })] })}- conch-user-inf-a77wo.ondigitalocean.app
Mixpanel API host configured by the extension for analytics events, including Text Selected.
Analytics configured to collect your IP and ignore Do Not Track
Conch AI initializes Mixpanel with ignore_dnt:true, overriding Do Not Track, and ip:true, logging IP per event.
Traffic routes through a DigitalOcean proxy, not standard Mixpanel endpoints.
DA captured 6 POSTs with ip=1, regardless of DNT.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You install and open the Conch AI extension, even with Do Not Track enabled in your browser.
The extension sends analytics events to its server, including your IP address, without honoring your browser's Do Not Track preference.
The Mixpanel SDK is initialized with flags that explicitly disable DNT compliance and enable IP collection. This applies to every analytics event the extension sends.
Mixpanel initialization with non-default privacy flags, from the extension's shipping source.
Mixpanel SDK initialization — readable form
const MIXPANEL_TOKEN = '4477213da2d35dcd72db46a7bd7152f9';Mixpanel.init(MIXPANEL_TOKEN, { debug: true, // Overrides the browser's Do Not Track (DNT) setting. // Standard Mixpanel behavior would skip tracking when DNT is enabled. ignore_dnt: true, // Routes all events through Conch's own DigitalOcean proxy // rather than directly to Mixpanel's servers. api_host: 'https://conch-user-inf-a77wo.ondigitalocean.app', // Stores Mixpanel state in localStorage. persistence: 'localStorage', // Instructs the server to record the user's IP address // with every analytics event. ip: true,});HTTP 200 OK. The ip=1 URL parameter was present on all 6 captured requests, confirming the server is instructed to record the sender's IP address.
- Content-Type
- application/x-www-form-urlencoded
data=%5B%7B%22event%22%3A%22New%20Extension%3A%20Page%20Title%20and%20URL%22%2C%22properties%22%3A%7B%22token%22%3A%224477213da2d35dcd72db46a7bd7152f9%22%2C%22distinct_id%22%3A%22user%40example.com%22%2C%22email%22%3A%22user%40example.com%22%2C%22title%22%3A%22Google%22%2C%22url%22%3A%22https%3A%2F%2Fwww.google.com%2F%22%7D%7D%5D- conch-user-inf-a77wo.ondigitalocean.app
Conch AI's analytics proxy on DigitalOcean. Receives all Mixpanel events and forwards them to Mixpanel, with IP collection enabled via ip=1.
Page URL and title sent to analytics on every navigation
Every page visited with Conch AI active sends its title/URL to conch-user-inf-a77wo.ondigitalocean.app, with email attached.
DA captured 6 POSTs across Google, Amazon, Facebook, Wikipedia, and Reddit: "New Extension: Page Title and URL".
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You navigate to any web page while the Conch AI extension is installed and open.
The extension reads the page title and URL and sends them to Conch's analytics server, tagged with your email address.
This fires on every page load, every browser history navigation (popstate), and every time a tab regains visibility.
HTTP 200 OK. This request pattern was observed 6 times across 5 sites visited in our test session (Google appeared twice).
- Content-Type
- application/x-www-form-urlencoded
data=%5B%7B%22event%22%3A%22New%20Extension%3A%20Page%20Title%20and%20URL%22%2C%22properties%22%3A%7B%22token%22%3A%224477213da2d35dcd72db46a7bd7152f9%22%2C%22distinct_id%22%3A%22user%40example.com%22%2C%22email%22%3A%22user%40example.com%22%2C%22title%22%3A%22Wikipedia%2C%20the%20free%20encyclopedia%22%2C%22url%22%3A%22https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FMain_Page%22%7D%7D%5D- Page URLhttps://en.wikipedia.org/wiki/Main_Page
The full address of every page you visit, including any query parameters.
- Page titleWikipedia, the free encyclopedia
The title of the page as shown in your browser tab.
- Your email addressuser@example.com
The email you used to sign in. Attached to every event, linking all page visits to your account.
- Mixpanel distinct IDuser@example.com
A persistent identifier used by Mixpanel to track you across sessions. Set to your email.
The code that captures and sends page URLs, from the extension's shipping source.
Content script: fires on every load, back/forward navigation, and tab focus
// Reads the current page title and URL and forwards them to the popupfunction capturePageInfo() { const title = document.title || ''; const url = window.location.href || ''; chrome.runtime.sendMessage({ type: 'PAGE_TITLE_AND_URL', title, url });}function onNavigation() { capturePageContent(); // also sends full page text capturePageInfo();}// Fires on every page load, back/forward navigation, and tab becoming visiblewindow.addEventListener('load', onNavigation);window.addEventListener('popstate', onNavigation);document.addEventListener('visibilitychange', () => { if (!document.hidden) onNavigation();});Popup: receives message and tracks via Mixpanel
// In the popup's message listener:if (message.type === 'PAGE_TITLE_AND_URL') { this.setState({ pageTitle: message.title, pageUrl: message.url }); track('Page Title and URL', { title: message.title, url: message.url });}// track() adds the user's email and sends to Mixpanel:function track(eventName, properties) { Mixpanel.track('New Extension: ' + eventName, { email: localStorage.getItem('email') || '', ...properties });}- conch-user-inf-a77wo.ondigitalocean.app
Conch AI's custom Mixpanel proxy on DigitalOcean. Receives every page-visit event including URL, title, and user email.
What it can do
Permissions this extension asks for, as declared in version 1.3.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage