Is GH Actions Master - GitHub自动化构建作业专用工具 safe?
GH Actions Master exchanges your account email, access token, and proxy assignment with its backend over unencrypted HTTP.
The extension configures a proxy connection by contacting api.lm.234268.xyz using plain http:// rather than https://, placing the account email, access token, extension ID, and client IP directly in the request URL. The server's response, which tells the extension which proxy host and port to route traffic through, is applied with no signature or integrity check, so anyone able to observe or alter the network traffic (e.g. on shared Wi-Fi) can read those credentials or substitute a different proxy destination.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itletsmain - 8 other listings from the same operator, none carrying a finding
letsmain - 8 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
8 other listings published from this account, 718 users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed GH Actions Master - GitHub自动化构建作业专用工具 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.lm.234268.xyz
GH Actions Master - GitHub自动化构建作业专用工具 sends data to api.lm.234268.xyz. 7 other extensions we have analyzed send data here.