Is Live editor for CSS, Less & Sass - Magic CSS safe?
Magic CSS is medium risk. Magic CSS contacts the developer's metrics server on install, update, and launch, sending a persistent ID, User-Agent, OS, browser, language, saved-CSS count, open count. Address comes from remote config; fires only via flag, path is wired.…
Who publishes itWebExtensions Private Limited - 1 other listing from the same operator, none carrying a finding
WebExtensions Private Limited - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 9k+ users between them, none of them carrying a finding.
Shared hosts - 9 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Telemetry sends persistent device ID and browser fingerprint on install/update
Magic CSS contacts the developer's metrics server on install, update, and launch, sending a persistent ID, User-Agent, OS, browser, language, saved-CSS count, open count.
Address comes from remote config; fires only via flag, path is wired.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install or update the extension, or it fetches a fresh remote config.
Also fires on each successful remote config fetch (event: 'configFetch').
The background service worker assembles a fingerprint payload and sends it to the developer's metrics server.
The destination hostname and path come from the remote config, not from hardcoded values in the extension source.
- Persistent device IDa3f1c27e-84b2-4d91-9f03-e6a7b5c01234
A UUID generated on first run, stored permanently in chrome.storage.local. Links every telemetry event to your device across sessions.
- Full User-Agent stringMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Your browser's complete User-Agent, including browser name, version, and OS details.
- Operating systemmacOS
Your OS platform derived from navigator.platform and navigator.userAgent.
- Sites with saved CSS14
Count of distinct origins for which you have stored CSS rules. Reflects the breadth of your browsing and customization activity.
- Editor launch count47
How many times you have opened the Magic CSS editor, read from chrome.storage.local.
- Browser languageen-US
Your browser's language setting (navigator.language) and full language preference list.
On every browser startup
Fires on extension install (event: 'install'), on version update (event: 'update'), and each time a fresh remote config is fetched from api.webextensions.org (event: 'configFetch'). The remote config is fetched at startup and then on a schedule driven by remoteConfig.nextUpdate (default 7 days).
detailsGenerator(), builds the payload sent to the metrics server
// detailsGenerator() — lines 404-464 of background-magicss.bundle.js// Assembles the telemetry payload:// uuid — persistent ID from chrome.storage.local (instance-uuid key)// launchesCount — editor open count from magicss-execution-counter// version — extension version from manifest// lang / langsList — navigator.language / navigator.languages// os — platform string (macOS, Windows, Linux, etc.)// browser / browserVersion — detected from UA// ua — navigator.userAgent (full string)// editMode — 'css' or 'less' (user preference)// theme / indent / storage — other preferences// originsCount — count of unique origins with saved CSS rules//// metricsUrlGenerator() serializes `details` as JSON and appends// it as the 'details' query param to:// remoteConfig.config.metricsApi.server + metricsApiCollectionPath// (server address comes from the live config at api.webextensions.org)- api.webextensions.org
Developer-operated config server. Serves the remote config that enables telemetry and provides the actual metrics API hostname and collection path.
Mixpanel behavioral tracking links editor interactions to a persistent device ID
Magic CSS sends editor events to Mixpanel under the developer's account, tied to a persistent UUID tracking usage: editor opens, Sass conversions, beautify/minify, clipboard copies, rate-us clicks.
Fires via flag; token is hardcoded.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You use any feature of the Magic CSS editor, open it, run a conversion, copy code, or click prompts.
Events are fired from main.bundle.js via sendEventMessageForMetrics() for each discrete interaction.
The background service worker forwards each event to Mixpanel, linking it to your persistent device UUID.
mixpanel.identify(instanceUuid) was called at initialization, so every subsequent track() call is tied to the same identity across all sessions.
Mixpanel initialization and event forwarding (background-magicss.bundle.js lines 85-153)
// Setup:// 1. Check dev mode — skip tracking if running as unpacked extension// 2. Read instanceUuid (instance-uuid) from chrome.storage.local// 3. Call mixpanel.init('672f8c9aa876de5834bc48330f074412')// 4. Call mixpanel.identify(instanceUuid) — ties all future events to this device's UUID//// Event routing (sendEventMessageForMetrics in main.bundle.js line 14-30):// Content script → chrome.runtime.sendMessage({type:'mixpanel', subType:'event', payload: {name, ...}})// Service worker receives → checks useMixpanel feature flag → mixpanel.track(evt.name, evt)//// Tracked event names observed in main.bundle.js:// 'rateUsOn_chrome', 'openGetIcon', 'lessOrSassToCss',// 'beautifyCode', 'minifyCode', 'copiedCodeToClipboard',// 'failedToCopyCodeToClipboard'- Persistent device ID (distinct_id)a3f1c27e-84b2-4d91-9f03-e6a7b5c01234
The UUID in storage.local Mixpanel uses to link your events across sessions. Set via mixpanel.identify(), attached to every track() call.
- Event namebeautifyCode
The editor action you performed, such as 'beautifyCode', 'lessOrSassToCss', or 'copiedCodeToClipboard'.
- api.mixpanel.com
Mixpanel Inc. analytics. Receives tracked events under the developer's project (token 672f8c9aa876de5834bc48330f074412). Data stored in the US under Mixpanel's policy.
What it can do
Permissions this extension asks for, as declared in version 8.22.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Act on the current tab, but only after you click the extension
activeTab
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
Run its own code inside the pages you visit
scripting
Run hidden pages in the background
offscreen