Is Lazy Scholar safe?

Medium risk

Lazy Scholar sends scholarly article details, page URLs, tab metadata, and a stored user ID to an AWS API.

When Lazy Scholar detects DOI or PMID metadata on a page, it sends article analytics once per page. The request includes article details such as title, authors, journal, citation and full-text metadata, plus the tab URL, tab title, tab IDs, browser/version fields, and a generated user ID unless data_permission is set to no.

Colby Vorlandv3.0.1Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Lazy Scholar sends your article page, title, and a persistent ID to AWS

We observed Lazy Scholar send the page URL, title, tab ID, article metadata, and a persistent user ID to its AWS endpoint on every DOI/PMID page you open.

This runs by default; it stops only if you turn data collection off in settings.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a page that contains a DOI or PMID, such as a PubMed record or a journal article.

The content script runs on every page you visit, not just scholarly ones, to check for this.

The extension did this

Lazy Scholar automatically sends the page URL, title, tab ID, article details, and a persistent user ID to an AWS endpoint it controls.

This happens on page load with no click or confirmation. It only stops if you have already set data collection to off in the options page; the setting sends by default.

What's in every analytics record
  • Page URL
    https://www.nejm.org/doi/full/10.1056/NEJMoa2001017

    The exact address of the article page you're reading.

  • Page title
    Efficacy and Safety of the mRNA-1273 SARS-CoV-2 Vaccine (illustrative)

    The title of the page as shown in your browser tab.

  • Persistent user ID
    684019

    A random ID created on first use and stored permanently, tying every future article you view back to the same profile across sessions.

  • Tab and window IDs
    tabid: 482, tabwindowid: 1

    Internal browser identifiers for the specific tab and window you had open.

  • Article identifiers
    doi: 10.1056/NEJMoa2001017, pmid: 31978945, journal: New England Journal of Medicine (illustrative)

    The DOI or PubMed ID of the article you're reading, plus the journal name.

  • Browser and extension version
    browser: chrome, version: 3.0.1

    Which browser and version of Lazy Scholar you're running.

Captured request
POSThttps://ifai3te216.execute-api.us-east-1.amazonaws.com/prod/ext

200 OK, small JSON acknowledgement

Headers
Origin
chrome-extension://fpbdcofpbclblalghaepibbagkkgpkak
Content-Type
application/json
Body
{  "paper": "10.1056/NEJMoa2001017",  "doiorpmid": "doi",  "paper_details": {    "tabindex": 0,    "tabwindowid": 1,    "pdf_list": [],    "free_fulltext_list": [],    "tabid": 482,    "tabtitle": "Efficacy and Safety of the mRNA-1273 SARS-CoV-2 Vaccine | NEJM",    "title": "Efficacy and Safety of the mRNA-1273 SARS-CoV-2 Vaccine",    "details": "N Engl J Med 2021; 384:403-416",    "year": "2021",    "fulltext": "",    "cites": "18452",    "wos": "",    "taburl": "https://www.nejm.org/doi/full/10.1056/NEJMoa2001017",    "taburl_mod": "nejm.org/doi/full/10.1056/NEJMoa2001017",    "cite_id": "",    "typeofquery": "auto",    "hostname": "www.nejm.org",    "gscholarrecord": "",    "email": "",    "pmid": "31978945",    "clintrial": "",    "doi": "10.1056/NEJMoa2001017",    "coi": "",    "pm_keywords": [],    "pm_classifications": [],    "first": "",    "title1": "",    "year1": "",    "second": "",    "title2": "",    "year2": "",    "third": "",    "title3": "",    "year3": "",    "fourth": "",    "title4": "",    "year4": "",    "fifth": "",    "title5": "",    "year5": "",    "authorlist_affiliations": "",    "pm_journal": "New England Journal of Medicine",    "sjr": "8.2",    "sjr_quartile": "Q1",    "journalguide": "",    "journalshort": "",    "journalfound": "true",    "title_crossref": "Efficacy and Safety of the mRNA-1273 SARS-CoV-2 Vaccine",    "authorlist": "Baden LR, El Sahly HM, Essink B, et al.",    "year_crossref": "2021",    "cites_crossref": "18452",    "publisher": "Massachusetts Medical Society",    "funder_award": "",    "funder_name": "BARDA, NIAID",    "citation": "",    "style": "",    "dissemin": "",    "hypothesis": 0,    "ms_cites": "",    "_id": "1757328622635 41208",    "version": "3.0.1",    "userid": 684019,    "timestamp": 1757328622635,    "timestampUTC": "Mon, 08 Sep 2026 10:43:42 GMT",    "browser": "chrome"  }}
The code that does this

The opt-out check runs after the record is already built

Readable version

Content script: fires once per page after metadata resolves

src/content/index.js
case MSG.METADATA_RESULT:  if (payload && payload.metadata) {    this.article = { ...this.article, ...payload.metadata };    InfobarInjector.show(this.article);    if (!this.analyticsSent) {      this.analyticsSent = true;      chrome.runtime.sendMessage({        type: 'SEND_ANALYTICS',        payload: { articleData: this.article }      }).catch(() => {});    }  }  sendResponse({ success: true });  break;

AnalyticsService: builds the record, then checks the opt-out flag

src/services/analytics/AnalyticsService.js
async sendToLambda(data, tabInfo, gsData = {}) {  try {    const storage = await chrome.storage.sync.get(['userid', 'browserType', 'data_permission']);    if (storage.data_permission === 'no') {      console.log('[Analytics] User opted out of data collection');      return { success: false, reason: 'opted_out' };    }    const paperDetails = this.buildPaperDetails(data, tabInfo, gsData);    let userid = storage.userid;    if (!userid) {      userid = Math.floor(Math.random() * 1000000) + 1;      await chrome.storage.sync.set({ userid });    }    paperDetails.userid = userid;    paperDetails.browser = storage.browserType || 'chrome';    const paper = data.doi || data.pmid || 'none';    const doiorpmid = data.doi ? 'doi' : (data.pmid ? 'pmid' : 'none');    const payload = { paper, doiorpmid, paper_details: paperDetails };    const response = await fetch(LAMBDA_ENDPOINT, {      method: 'POST',      headers: { 'Content-Type': 'application/json' },      body: JSON.stringify(payload)    });    const result = await response.json();    return { success: true, result };  } catch (error) {    return { success: false, error: error.message };  }}
Where the data goes
    • ifai3te216.execute-api.us-east-1.amazonaws.com

    Lazy Scholar's own AWS API Gateway/Lambda analytics endpoint. Not a third-party ad or data broker; receives every DOI/PMID page you view plus your persistent user ID.

What it can do

Permissions this extension asks for, as declared in version 3.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Write to your clipboard

    clipboardWrite

  • Start, monitor and manage your downloads

    downloads

  • Add items to the right-click menu

    contextMenus

  • Show you desktop notifications

    notifications

  • Schedule its own background tasks

    alarms

  • Detect when you step away from your computer

    idle

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Watch every request your browser makes

    webRequest

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Lazy Scholar contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ifai3te216.execute-api.us-east-1.amazonaws.com

    Lazy Scholar sends data to ifai3te216.execute-api.us-east-1.amazonaws.com. No other extension we have analysed sends data here.

Updated 30 September 2026fpbdcofpbclblalghaepibbagkkgpkak