Is instant-data-scraper safe?

Question

Accepted Answer

instant-data-scraper is high risk. Every time you navigate to a page in Chrome, Instant Data Scraper's service worker records the full URL you visited, the URL you came from, your referrer, how you got there, and a persistent identifier tied to your browser install. This record is encrypted with a hardcoded AES-256-CBC key baked into the extension's source code and transmitted to api.idscraper.com/table. Dynamic analysis captured 6 such requests during a two-minute session across Google and Amazon. The hardcoded key is extractable from the extension source, so any party with access to it can decrypt the full browsing history stream. In version 1.4.4, Instant Data Scraper added a server-controlled DOM-scraping framework. Every 60 seconds, the service worker fetches a set of scraping programs from api.idscraper.com/pages/selections. When you visit a page whose URL matches a server-defined pattern, the content script executes the corresponding program — collecting DOM text, element attributes, localStorage values, or image pixel data — and sends the results back to the service worker, which appends them to the encrypted navigation POST at api.idscraper.com/table. Dynamic analysis confirmed this polling loop and observed server-returned CSS selector programs targeting Google Maps search results.

Is Instant Data Scraper safe?

Findings