Is MAL-Sync safe?

Medium risk

MAL-Sync fetches remote configuration from chibi.malsync.moe to determine which anime sites receive dynamically registered content scripts.

MAL-Sync is an anime and manga tracking extension that synchronizes watch/read progress across services like MyAnimeList. To identify episodes on supported streaming sites, the extension fetches a list of supported sites from chibi.malsync.moe and dynamically injects content scripts into those pages at runtime. On chibi-supported sites, the injected script wraps the page's fetch and XMLHttpRequest functions to capture JSON API responses — including all JSON responses on the page, not just anime metadata — and passes them to the extension for episode identification.

lolamtischv0.12.5Chrome Web Store
45Risk
Who publishes it

lolamtisch - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
lolamtisch
Website
github.com/lolamtisch/MALSync/wiki/Support

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote server controls which sites receive injected content scripts

When MAL-Sync starts, it fetches a registry from chibi.malsync.moe and decides which streaming sites get a script injected into the page's JS environment (MAIN world), changeable without a new version if the registry is compromised.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

MAL-Sync starts in your browser.

The background service worker initialises and fetches the chibi page registry from chibi.malsync.moe.

The extension did this

The extension registers content scripts on streaming sites based on the remote response.

Sites listed with requestProxy: true in the remote config receive proxy_request.js injected at document_start with world: MAIN, giving it direct access to the page's JavaScript environment.

Captured request
GEThttps://chibi.malsync.moe/config/list.json

JSON registry listing streaming-site page entries with features.requestProxy: true for sites where the proxy_request.js hook should be injected. Confirmed in dynamic analysis: 3 GET requests to this endpoint from the background service worker on startup.

What's stored on your device

The remote config response, cached locally, is the sole input deciding which sites get MAIN-world injection on the next startup or refresh.

Location
chrome.storage.local key 'chibiPages/0.12.3'
Contents
{  "animeav1": {    "urls": {      "match": [        "*://*.netflix.com/*"      ]    },    "features": {      "requestProxy": true    }  },  "crunchyroll": {    "urls": {      "match": [        "*://*.crunchyroll.com/*"      ]    },    "features": {      "requestProxy": true    }  }}
The code that does this

Remote registry drives site list passed to chrome.scripting.registerContentScripts

Readable version

Repo list assembly — readable

background.js (deobfuscated)
// Extension mode: bundle the local chibi directory, plus the remote config endpoint,// plus any user-supplied extra repos from settings.const repos = [ chrome.runtime.getURL('chibi'), // bundled local directory 'https://chibi.malsync.moe/config', // developer-operated remote registry ...await settings.getAsync('chibiRepos'), // user-added arbitrary URLs];return new ChibiManager(repos, useCache);

Content script registration — readable

background.js (deobfuscated)
// For entries with t.proxy set (from remote config's requestProxy: true),// the script is registered directly in world: 'MAIN' (the page's own JS context).if (t.proxy) { scriptDef.id = `${scriptDef.id}-${t.page}`; scriptDef.js = [t.proxy]; // e.g. 'content/proxy/proxy_request.js' scriptDef.world = 'MAIN'; // full page JS context access} else { // Other script types use default ISOLATED world}await chrome.scripting.registerContentScripts([scriptDef]);
User-configurable extra repositories

Settings allow users to add their own chibiRepos URLs, which are fetched with equal trust alongside the developer's endpoint. A user who adds an untrusted URL, or whose added URL is later compromised, would cause the extension to register attacker-controlled scripts in MAIN world on sites covered by the extension's host permissions.

Hosts contacted to determine content script targets
    • chibi.malsync.moe

    Developer-operated registry deciding which streaming sites get the MAIN-world proxy_request.js injection. Changes here affect all installed users without an extension update.

Where it sends data

Destinations our analysis observed MAL-Sync contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • chibi.malsync.moe

    MAL-Sync sends data to chibi.malsync.moe. No other extension we have analysed sends data here.

  • myanimelist.net

    MAL-Sync sends data to myanimelist.net. No other extension we have analysed sends data here.

Updated 30 September 2026kekjfbackdeiabghhcdklcdoekaanoel