Is MAL-Sync safe?

Low risk

MAL-Sync embeds hardcoded OAuth client secrets for three third-party services in its extension bundle.

MAL-Sync stores OAuth client_secret values for Shikimori, MangaBaka, and Simkl directly in its JavaScript source files. These secrets are sent in POST requests to each service's token endpoint during authorization and token refresh flows. Any party who obtains a valid authorization code for these apps could use the embedded secret to exchange it for an access token appearing to originate from MAL-Sync.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

lolamtischv0.12.5Firefox Add-ons
15Risk
Who publishes it

lolamtisch - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
lolamtisch
Website
github.com/lolamtisch/MALSync

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 0.12.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on myanimelist.net

    https://myanimelist.net/

  • Read and change your data on cdn.myanimelist.net

    https://cdn.myanimelist.net/

  • Read and change your data on kissanimelist.firebaseio.com

    https://kissanimelist.firebaseio.com/

  • Read and change your data on anilist.co

    https://*.anilist.co/

  • Read and change your data on graphql.anilist.co

    https://graphql.anilist.co/

  • Read and change your data on kitsu.app

    https://kitsu.app/

  • Read and change your data on media.kitsu.app

    https://media.kitsu.app/

  • Read and change your data on api.simkl.com

    https://api.simkl.com/

  • Read and change your data on www.netflix.com

    https://www.netflix.com/

  • Read and change your data on discover.hulu.com

    https://discover.hulu.com/

  • Read and change your data on www.primevideo.com

    https://www.primevideo.com/

  • Read and change your data on www.crunchyroll.com

    https://www.crunchyroll.com/

  • Read and change your data on api.malsync.moe

    https://api.malsync.moe/

  • Read and change your data on chibi.malsync.moe

    https://chibi.malsync.moe/

  • Read and change your data on api.myanimelist.net

    https://api.myanimelist.net/

  • Read and change your data on api.mangadex.org

    https://api.mangadex.org/

  • Read and change your data on api.mangabaka.org

    https://api.mangabaka.org/

  • Read and change your data on mangabaka.org

    https://*.mangabaka.org/

  • Read and change your data on shikimori.io

    https://shikimori.io/

  • Read and change your data on plex.direct

    https://*.plex.direct/

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Show you desktop notifications

    notifications

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed MAL-Sync contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.simkl.com

    MAL-Sync sends data to api.simkl.com. One other extension we have analyzed sends data here.

  • mangabaka.org

    MAL-Sync sends data to mangabaka.org. No other extension we have analyzed sends data here.

  • shikimori.one

    MAL-Sync sends data to shikimori.one. No other extension we have analyzed sends data here.

Updated 2 November 2026amo-1002080