Is Kondo safe?
Kondo's localhost bridge can return LinkedIn session cookies through its extension RPC.
Kondo injects a content-script bridge on localhost development pages and Kondo app origins, then forwards message ports into its privileged extension context. That RPC includes a profile request that reads LinkedIn cookies, including the li_at session cookie, and returns them with LinkedIn profile/session data.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itTeam Beluga Pte Ltd. - no other listings under this identity
Team Beluga Pte Ltd. - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Kondo contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- app.trykondo.com
Kondo sends data to app.trykondo.com. No other extension we have analyzed sends data here.
- kondo-alpha.pages.dev
Kondo sends data to kondo-alpha.pages.dev. No other extension we have analyzed sends data here.
- kondo-beta.pages.dev
Kondo sends data to kondo-beta.pages.dev. No other extension we have analyzed sends data here.
- kondo-gamma.pages.dev
Kondo sends data to kondo-gamma.pages.dev. No other extension we have analyzed sends data here.
- localhost:5173
Kondo sends data to localhost:5173. Named as a recipient in this extension's own analysis.