Is Hudu Password Manager safe?

Hudu Password Manager's passkey origin check lacks public-suffix logic, letting a shared subdomain spoof its parent as the passkey rp.id.

Hudu Password Manager stores credentials and manages WebAuthn/passkey creation and sign-in directly in the browser, showing a consent prompt before each passkey action. Its check that a page's requested rp.id matches its own origin only verifies that the origin ends with the rp.id string, without accounting for public suffixes. A page hosted on a shared platform domain (for example a *.github.io or *.vercel.app subdomain) can therefore request a passkey scoped to that shared parent domain rather than its own site, letting it register or look up passkeys meant for other sites on the same platform.

Rated medium risk because of who publishes it: 1 of the 1 other listing from the same operator is rated high or critical for malicious behavior. Flagged: Hudu Assist (high).