Is Eclipse IDE online safe?
Eclipse IDE online is medium risk. On first load, the extension generates a random 10-char ID, stores it in local and synced storage, and attaches it to every request to offidocs.com and clickasound.com. Synced storage tracks it across Chrome installs on your account.
Who publishes itofficeonlinesystems - 26 other listings from the same operator, 17 of them carrying a finding
officeonlinesystems - 26 other listings from the same operator, 17 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
19 other listings published from this account, 1.5M+ users between them. 14 of them carry a finding.
Same operator - 7 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Persistent tracking ID auto-generated and sent to two third-party domains
On first load, the extension generates a random 10-char ID, stores it in local and synced storage, and attaches it to every request to offidocs.com and clickasound.com.
Synced storage tracks it across Chrome installs on your account.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install the extension.
No user action is required beyond installation.
The extension generates a 10-character random ID and stores it in both local and synced Chrome storage without presenting a consent prompt.
The same ID is sent with every subsequent request to offidocs.com and clickasound.com.
The 'username' value is the persistent tracking ID. It is created on first load and never changes unless the user clears extension data.
- Location
- chrome.storage.local, key 'offidocs_key'
{ "username": "8dhiia0fbo", "offidocscloud": "1"}Tracking ID generation and storage (popup.js:16-34 and websecure.js:38-44)
What popup.js does
// Check local storage for an existing ID; create one if absentconst stored = await chrome.storage.local.get('offidocs_key');let trackingId = stored?.offidocs_key?.username;if (!trackingId) { trackingId = randomString(10); // e.g. '8dhiia0fbo' await chrome.storage.local.set({ offidocs_key: { username: trackingId, offidocscloud: '1' } });}What websecure.js does (sync storage, follows Google account)
// Additionally written to sync storage — persists across Chrome installschrome.storage.sync.get('username', (obj) => { if (!obj.username) { const trackingId = randomString(10); chrome.storage.sync.set({ username: trackingId }); }});- Tracking ID8dhiia0fbo
A 10-character random identifier generated on first install. Sent as 'username' or 'u' query parameter on every request to both domains.
- www.offidocs.com
Primary backend. Receives the tracking ID on requests to checkregistereclipse_user_x_2_nav.php, view_edit_eclipse_nav.php, preprefile.php, and viewnovnc_ext.php.
- www.clickasound.com
Secondary backend. Receives the tracking ID on requests to community/user.php over cleartext HTTP.
What it can do
Permissions this extension asks for, as declared in version 2.3.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab