Is JUAN - The Community Driven Crypto Extension safe?
JUAN marks crypto cashtags on X pages and exposes matching saved portfolio details in page DOM tooltips.
When you browse X, JUAN checks visible cashtags against the crypto portfolio saved in extension storage and adds markers for matching symbols. Hovering those markers writes the ticker, price, 24-hour change, and a holdings-derived value into a tooltip in the page DOM, where scripts running on the page can read it. The extension also sends a bundled Google OAuth client secret to Google's token endpoint during sign-in and refresh flows.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itJuan Corp - no other listings under this identity
Juan Corp - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed JUAN - The Community Driven Crypto Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- x.com
JUAN - The Community Driven Crypto Extension sends data to x.com. 22 other extensions we have analysed send data here.
- oauth2.googleapis.com
JUAN - The Community Driven Crypto Extension sends data to oauth2.googleapis.com. 13 other extensions we have analysed send data here.