Is FantasyPros: Win your Fantasy League safe?

FantasyPros injects a content script on all pages that can be triggered by any site to read and transmit a user's Sleeper auth token.

The extension registers a content script on every website that responds to document-level CustomEvent messages dispatched by any page script. When the event carries a token-fetch command, the extension silently opens a hidden Sleeper.com tab, reads the user's Sleeper localStorage token, and posts it to mpbnfl.fantasypros.com. No check is made to verify that the triggering page originates from fantasypros.com.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.