Is HiSider: Multi-Model Assistant safe?
HiSider trusts any page on http://localhost:8080 to read or overwrite its stored account token.
HiSider registers message handlers (GET_USERINFO/SET_USERINFO) that read and write its stored account object, including the login bearer token, and exposes them to external pages via chrome.runtime.onMessageExternal. Its manifest's externally_connectable list is scoped to the vendor's own hisider.ai/dev/net/com domains but also includes the bare origin http://localhost:8080/*, so any unrelated local service or page a user happens to be running on that common dev-server port is treated as fully trusted and can fetch or overwrite the stored token with no further check.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes ithisiderteam - no other listings under this identity, 2 shared hostnames
hisiderteam - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 3.0.22. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Show a panel beside the page
sidePanel
Store data in your browser
storage
Run its own code inside the pages you visit
scripting