Is Free B2B Contact Info by AroundDeal safe?

#!/usr/bin/env node/** * detect-unscoped-nav-listener.js * * Flags extensions whose declared content-script scope (manifest.json * "content_scripts"[].matches) is far narrower than their granted * host_permissions, while the background script registers a * chrome.tabs.onUpdated listener that fetches out to a remote host on * every navigation. That combination is the shape used to report a * user's full browsing history to a vendor's own backend under the * guise of a single-site tool. * * Usage: *   node detect-unscoped-nav-listener.js <path-to-unpacked-extension> * * Requires: Node.js 18+ */const fs = require('fs');const path = require('path');function readJSON(file) {  return JSON.parse(fs.readFileSync(file, 'utf8'));}function findBackgroundFile(root, manifest) {  const sw = manifest.background && manifest.background.service_worker;  if (!sw) return null;  const p = path.join(root, sw);  return fs.existsSync(p) ? p : null;}function contentScriptHosts(manifest) {  const scripts = manifest.content_scripts || [];  const hosts = new Set();  for (const cs of scripts) {    for (const m of cs.matches || []) hosts.add(m);  }  return [...hosts];}function isBroadPermission(p) {  return p === '<all_urls>' || /^https?:\/\/\*\/\*$/.test(p);}function main() {  const root = process.argv[2];  if (!root) {    console.error('Usage: node detect-unscoped-nav-listener.js <extension-dir>');    process.exit(1);  }  const manifestPath = path.join(root, 'manifest.json');  if (!fs.existsSync(manifestPath)) {    console.error(`No manifest.json at ${manifestPath}`);    process.exit(1);  }  const manifest = readJSON(manifestPath);  const hostPerms = manifest.host_permissions || [];  const csHosts = contentScriptHosts(manifest);  const broadHostPerms = hostPerms.filter(isBroadPermission);  const scopeMismatch =    broadHostPerms.length > 0 &&    csHosts.length > 0 &&    !csHosts.some(isBroadPermission);  const bgFile = findBackgroundFile(root, manifest);  let listenerHit = false;  let fetchHosts = [];  if (bgFile) {    const src = fs.readFileSync(bgFile, 'utf8');    const hasOnUpdated = /chrome\.tabs\.onUpdated\.addListener/.test(src);    const hasFetch = /fetch\s*\(/.test(src);    listenerHit = hasOnUpdated && hasFetch;    const urlRe = /fetch\(\s*['"`](https?:\/\/[^'"`/]+)/g;    let m;    while ((m = urlRe.exec(src))) fetchHosts.push(m[1]);    fetchHosts = [...new Set(fetchHosts)];  }  console.log(`Extension: ${manifest.name || '(unknown)'} v${manifest.version || '?'}`);  console.log(`host_permissions: ${hostPerms.join(', ') || '(none)'}`);  console.log(`content_scripts matches: ${csHosts.join(', ') || '(none)'}`);  console.log(`tabs.onUpdated + fetch in background: ${listenerHit}`);  console.log(`fetch() destinations seen in background: ${fetchHosts.join(', ') || '(none)'}`);  if (scopeMismatch && listenerHit) {    console.log('\n[FLAG] host_permissions are unscoped (all sites) while content_scripts');    console.log('       are limited to a single site, and the background worker fetches');    console.log('       out to a remote host on every navigation. This shape lets the');    console.log('       extension observe and report every site you visit, not just the');    console.log('       one its content script runs on. Read the onUpdated handler in');    console.log(`       ${bgFile} to see what it sends and where.`);    process.exitCode = 2;  } else {    console.log('\nNo mismatch of this shape detected.');  }}main();