Is GH Copilot Master - GitHub人工智能助手AI工具 safe?
GH Copilot Master sends your account email and session token to its backend over unencrypted HTTP.
The extension's backend API is hardcoded to a plaintext http:// endpoint, so requests for account access tokens, connection setup, and usage data embed the account email and access token directly in the URL and are sent unencrypted. A content script version of the popup logic also runs on every page you visit, triggering an outbound request to the same backend to fetch your client IP even if you never open the extension's popup.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itletsmain - 8 other listings from the same operator, 1 of them carrying a finding
letsmain - 8 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
8 other listings published from this account, 672 users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 3.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Read and change cookies, including the ones that keep you signed in
cookies
Store data in your browser
storage
Route all of your browsing through a server of its choosing
proxy
Block and redirect the requests your browser makes
declarativeNetRequest
Where it sends data
Destinations our analysis observed GH Copilot Master - GitHub人工智能助手AI工具 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.lm.234268.xyz
GH Copilot Master - GitHub人工智能助手AI工具 sends data to api.lm.234268.xyz. 3 other extensions we have analyzed send data here.