Is EE-Entry Filler safe?

Medium risk

EE-Entry Filler loads a script from rch-en.netlify.app into rch.mohfw.gov.in pages and removes their security headers.

On the Indian RCH health portal, the extension fills entry forms from Excel data. It also adds a script from a third-party Netlify host that runs in the page, and a built-in rule strips the portal's X-Frame-Options and Content-Security-Policy headers. The remote script's logic is not included in the package, so what it does with page content or form input cannot be seen.

v2.1.6Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

RCH helper pulls remote script from rch-en.netlify.app into health record pages

Code analysis shows the extension requests a script from rch-en.netlify.app and places it in rch.mohfw.gov.in pages.

That script's logic is not shipped in the package.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You open a record-entry page such as MotherANC.aspx on rch.mohfw.gov.in.

The extension did this

The extension adds a script element pointing at rch-en.netlify.app to the page.

The remote file is not included in the extension package.

The code that does this

Loader branch and the helper that creates the script element

Readable version

Branch selecting the remote URL

contentScript16.js
// appSK111 decodes to 'firefox', so this is true on Chromeif ("chrome" !== decode(getMessage("appSK111"))) { /* Firefox path */ }else await injectScript(decode(getMessage("appSU055")) + "scripts/contentScripts16.js", "body", 200);// appSU055 decodes to https://rch-en.netlify.app/

Helper that appends the element

contentScript16.js
const s = document.createElement("script");s.setAttribute("script-link", url);document.body.appendChild(s);
What governs the remote load
  • Remote host
    https://rch-en.netlify.app/scripts/contentScripts16.js

    Code comes from a Netlify site, not from the extension package.

  • Integrity check
    none

    No hash or signature limits what the remote file can contain.

  • Page CSP
    content-security-policy: remove (rch.mohfw.gov.in)

    A network rule removes CSP and frame headers on the RCH site.

  • Pages affected
    rch.mohfw.gov.in/RCH/UI/MotherANC.aspx

    Pages hold maternal and child health records and form inputs.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed EE-Entry Filler contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • rch-en.netlify.app

    EE-Entry Filler sends data to rch-en.netlify.app. No other extension we have analysed sends data here.

Updated 15 October 2026hacjncmmhhdidagdedkingkoclgfnefn