Is DivMagic safe?
DivMagic sends a screenshot and the HTML/CSS of each element you select to its servers after a 10-second delay.
When you select an element on a page, the extension captures an image of it, its HTML with computed styles, the page origin, its XPath and a persistent user id. It uploads the image to cdn.divmagic.com and posts the rest to api.divmagic.com, marked as hidden because you did not save it. This happens even when no save action is taken.
Who publishes itBL - no other listings under this identity, 6 shared hostnames
BL - no other listings under this identity, 6 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 6 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
DivMagic uploads a screenshot and HTML of any element you select
Code analysis shows that selecting an element sends its screenshot, HTML/CSS, page origin and a stored user id to divmagic.com after 10 seconds, flagged as not saved by the user, with no save click.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You click an element in DivMagic select mode and do not press Copy, Save or Export.
About 10 seconds later the extension uploads a screenshot and the element's HTML/CSS to divmagic.com.
- Element HTML/CSS<div style="display:flex;...">...</div>
The selected element's markup with computed styles inlined.
- Page originhttps://example.com
The site where you selected the element.
- XPath/html/body/div[1]/main/section[2]
The location of the element in the page.
- Image URLhttps://cdn.divmagic.com/upload/4829173650.webp
Link to the uploaded screenshot of the element.
- Persistent user iddivmagic-user-v2 id (value varies per install)
Id read from stored settings; links captures to one install.
- Not-saved flagtrue
True when the user did not save the element.
Content script sends the capture after a 10 s timer
Ur() in contentScript.bundle.js
contentScript.bundle.js async function Ur(e = !1) { try { if (!Dr) return; const t = await qt("divmagic-user-v2"), r = await zr({ isSavedByUser: !1 }), a = fr(Dr), i = await Pt(Dr, {}, { componentFormat: "html", styleFormat: e ? "external" : "inline", copyMode: "adaptable", includeMediaQuery: !0 }, "firefox"); e ? dr.runtime.sendMessage({ source: "modal", type: "SAVE_ELEMENT", data: i, xpath: a, url: window.location.origin, id: t.id || "undefined", imageUrl: r, isWordpress: !0 }).then((e => { "Success" === e.message && window.postMessage({ type: "DIVMAGIC_OFFPAGE", text: "ELEMENT_EXPORTED_TO_WORDPRESS" }, "*"), setTimeout((() => { vr = !1, xr = !1, wr = !1, Rr(), jr(), Ot(), Dr = null }), 6e3) })).catch((e => { 0 })) : setTimeout((() => { dr.runtime.sendMessage({ source: "modal", type: "SAVE_ELEMENT", data: i, xpath: a, url: window.location.origin, id: t.id || "undefined", imageUrl: r }).then((() => {})).catch((e => { 0 })) }), 1e4) } catch (e) { 0 }Background uploads image then posts record with not-saved flag
SAVE_ELEMENT handler
background.bundle.js })(), !0) : "object" == typeof e && "modal" === e.source && "SAVE_ELEMENT" === e.type ? ((async () => { try { let { imageUrl: t } = e; if (t && "string" != typeof t) { const e = encodeURIComponent(`${(()=>{let e="";for(let t=0;t<10;t+=1)e+=Math.floor(10*Math.random());return e})()}`), r = `https://cdn.divmagic.com/${`upload/${e}.webp`}`, n = new Uint8Array(t), a = new Blob([n], { type: "image/webp" }); await fetch(r, { method: "PUT", body: a, headers: { "Content-Type": "image/webp" } }).then((e => { t = 200 === e.status ? r : "" })).catch((e => { t = "" })) } fetch("https://api.divmagic.com/v1/private/component/save", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ url: e.url, xpath: e.xpath, output: e.data, id: e.id, imageUrl: t, hidden: !e.isSavedByUser, isWordpress: e.isWordpress }) }).then((e => e.json())).then((e => { r(e) })).catch((e => { r({ error: "Error" }) }))- cdn.divmagic.com
Receives the webp screenshot by PUT.
- api.divmagic.com
Receives the element HTML, XPath, origin and user id by POST.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 2.2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on 9xunk3m414.execute-api.us-east-1.amazonaws.com
https://9xunk3m414.execute-api.us-east-1.amazonaws.com/*
Read and change your data on api.divmagic.com
https://api.divmagic.com/*
Read and change your data on divmagic.com
https://divmagic.com/*
Read and change your data on www.divmagic.com
https://www.divmagic.com/*
Run its own code inside the pages you visit
scripting
Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
Write to your clipboard
clipboardWrite
Add items to the right-click menu
contextMenus
Where it sends data
Destinations our analysis observed DivMagic contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.divmagic.com
DivMagic sends data to api.divmagic.com. One other extension we have analysed sends data here.
- cdn.divmagic.com
DivMagic sends data to cdn.divmagic.com. One other extension we have analysed sends data here.