Is Hunter - Email Finder Extension safe?

Findings

// Fires on every completed navigation
chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => {
  if (tab && tab.url !== undefined && changeInfo.status === "complete") {
    LaunchColorChange(); // sends the new domain to hunter.io
  }
});

// Fires on every tab switch
chrome.tabs.onActivated.addListener(() => {
  LaunchColorChange(); // sends the newly-active tab's domain to hunter.io
});

function dataFoundForDomain(domain, callback) {
  const url = `https://extension-api.hunter.io/data-for-domain?domain=${domain}`;
  fetch(url)
    .then(response => response.json())
    .then(result => callback(result === 1))
    .catch(() => callback(false));
}

What it can do

Permissions this extension asks for, as declared in version 3.1.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 3.2.0, which we have not unpacked yet.

• Read and change your data on hunter.io

  https://*.hunter.io/

• See the address and title of every tab you have open

  tabs

• Store data in your browser

  storage

Where it sends data

Destinations our analysis observed Hunter contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

• extension-api.hunter.io

  Hunter sends data to extension-api.hunter.io. 2 other extensions we have analysed send data here.

• hunter.io

  Hunter sends data to hunter.io. No other extension we have analysed sends data here.