Is Mango Helper safe?

Medium risk

Mango Helper is medium risk. Mango Helper builds usage records from Mango Office portal activity and posts them to `http://192.168.41.60:9091/mango_helper/metric`, adding page URL, billing ID, user agent, timestamp, and search query to each message.

MANGO TELECOM LLCv3.0.17Chrome Web Store
45Risk
Who publishes it

MANGO TELECOM LLC - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

mango-office.ru
Also called by 1 other listing: Click-to-call для MANGO OFFICE
lk.mango-office.ru
Also called by 2 other listings, including Click-to-call для MANGO OFFICE

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Usage metrics sent to a private-network endpoint

Mango Helper builds usage records from Mango Office portal activity and posts them to `http://192.168.41.60:9091/mango_helper/metric`, adding page URL, billing ID, user agent, timestamp, and search query to each message.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You interact with Mango Office portal pages or type into the extension-added search box.

The extension did this

The extension builds a usage metric and sends it to a hardcoded private-network endpoint.

02EvidenceFIELD TABLE
Fields constructed before the metric POST
FieldValueWhy it matters
Metric event
lk_search_startedShows which portal action or search event happened.
Billing identifier
77123456789Links the event to the Mango Office billing context stored in the browser.
Page URL
https://lk.mango-office.ru/77123456789/members/indexShows the portal page where the action happened.
Browser user agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/126.0.0.0 Safari/537.36Identifies the browser and operating-system profile that generated the event.
Event time
2026-07-12T12:48:56.333ZRecords when the portal action occurred.
Search query
переадресацияCaptures what you typed into the portal search box.
03EvidenceNETWORK CAPTURE
Captured request
POSThttp://192.168.41.60:9091/mango_helper/metric
No live response body was recorded; the URL, method, and headers are reconstructed from the shipped service-worker source.
Headers
Content-Typeapplication/json
04EvidenceCODE COMPARE
The code that does this

Search fields are packaged, then the service worker posts them

What it actually does
Service worker POST handlerdeobfuscated/sourcecode/background.js
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
  if (message.type === "openExtension" || message.type === "openMainMenu") {
    const { sip, password, ext, bid, name } = message;
    let url = `/html/app.html?${btoa(
      `sip=${sip}&password=${password}&ext=${ext}&bid=${bid}&name=${name}`
    )}`;

    // Если тип сообщения openMainMenu, добавляем параметр для перехода на главное меню
    if (message.type === "openMainMenu") {
      url += "&main=true"; // Это параметр, который будет обрабатываться на стороне app.html
    }

    chrome.tabs.create({ url: chrome.runtime.getURL(url) }, () => {});
    return true;
  }
  if (message.type === "sendMetric") {
    fetch("http://192.168.41.60:9091/mango_helper/metric", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        event_type: message.eventType,
        user_info: message.userInfo,
        details: message.details
      })
    })
    .then(response => response.json())
    .then(data => {
      sendResponse({ success: true, data: data });
    })
    .catch(error => {
      console.error("Background: Metric error:", error);
      sendResponse({ success: false, error: error.message });
    });
    
    return true; // Асинхронный ответ
  }

  sendResponse({ success: false, message: "Unknown message type" });
});
Search metric builderdeobfuscated/sourcecode/search_input_into_lk.js
function(t, e) {
          var l = {
            billing_id: localStorage.getItem("billing"),
            timestamp: (new Date).toISOString(),
            url: window.location.href,
            user_agent: navigator.userAgent
          };
          if (e && "object" == typeof e)
            for (var i in e) Object.prototype.hasOwnProperty.call(e, i) && (l[i] = e[i]);
          try {
            chrome.runtime.sendMessage(chrome.runtime.id, {
              type: "sendMetric",
              eventType: t,
              userInfo: {
                email: "",
                name: "",
                login: ""
              },
              details: l
            }, function(t) {
              chrome.runtime.lastError || t && t.success
            })
          } catch (t) {}
        }("lk_search_started", {
          search_query: t,
          search_source: "header_search"
        }));
05EvidenceTHIRD PARTY LIST
Metric destination
  • 192.168.41.60

    Receives metric POSTs at /mango_helper/metric on port 9091; the address is an RFC1918 private-network host.

What it can do

Permissions this extension asks for, as declared in version 3.0.17. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on testairchat.mangotele.com:8039

    https://testairchat.mangotele.com:8039/*

  • Read and change your data on localhost

    http://localhost/*

  • Read and change your data on 127.0.0.1

    http://127.0.0.1/*

  • See the address and title of every tab you have open

    tabs

  • Act on the current tab, but only after you click the extension

    activeTab

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Keep running in the background while your browser is open

    background

Updated 30 September 2026joioophepbodkfjcjpoeofkgdblahbfe