Is Node Inspector Manager (NIM) safe?

Medium risk

Node Inspector Manager sends Chrome profile identity and debugger session details to analytics services.

On install, the extension reads the Chrome profile identity, encrypts it, stores it locally, and posts it to June07 analytics with the install reason. When a DevTools protocol socket is attached, it sends Google Analytics events that include the socket URL, tab ID, profile ID, and debugger pause or resume details.

June07v3.13.3Chrome Web Store
49Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Node Inspector Manager sends your Chrome profile identity to June07 on install

When you install Node Inspector Manager, it reads the email address and account ID tied to your Chrome profile, encrypts them, and sends them to analytics.june07.com.

This happens automatically on install, before you use any feature.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install or update Node Inspector Manager.

The extension did this

The extension reads your Chrome profile email and account ID, encrypts them, and sends them to analytics.june07.com.

This runs automatically inside the install event handler, with no separate consent prompt.

Fields read from your Chrome profile and transmitted
  • Chrome account email
    jane.doe@gmail.com

    The email address signed into your Chrome profile.

  • Chrome account ID
    108234871234567890123

    A stable Google account identifier tied to your Chrome profile.

  • Install reason
    install

    Whether this was a fresh install or an update.

Captured request
POSThttps://analytics.june07.com/install

Observed during dynamic analysis: POST fired immediately after the onInstalled(install) event, repeated on the onInstalled(update) event.

Headers
Content-Type
application/json
Body
{  "source": "nim",  "userInfo": "<nonce> <ephemeral-public-key> <nacl-box ciphertext>",  "onInstalledReason": "install"}
The code that does this

Reading, encrypting, and sending your Chrome profile identity

Readable version

Annotated: what each step actually does

src/sw.js
function encryptMessage(profileObject, vendorPublicKey) {    // profileObject is {email, id} from your Chrome profile    const clientPrivateKey = nacl.randomBytes(32)    // Falls back to a public key hardcoded in the extension:    const publicKey = vendorPublicKey        ? nacl.util.decodeBase64(vendorPublicKey)        : nacl.util.decodeBase64('cXFjuDdYNvsedzMWf1vSXbymQ7EgG8c40j/Nfj3a2VU=')    const nonce = crypto.getRandomValues(new Uint8Array(24))    const keyPair = nacl.box.keyPair.fromSecretKey(clientPrivateKey)    const plaintext = nacl.util.decodeUTF8(JSON.stringify(profileObject))    // Only the holder of the matching private key (June07) can decrypt this:    const ciphertext = nacl.box(plaintext, nonce, publicKey, keyPair.secretKey)    return nacl.util.encodeBase64(nonce) + ' ' + nacl.util.encodeBase64(keyPair.publicKey) + ' ' + nacl.util.encodeBase64(ciphertext)}async function getUserInfo() {    // Reads your Chrome-signed-in account email + account ID:    const profile = await chrome.identity.getProfileUserInfo()    const encryptedProfile = encryptMessage(profile)    chrome.storage.local.set({ userInfo: encryptedProfile })    return encryptedProfile}
Where the data ends up
    • analytics.june07.com

    Receives your encrypted Chrome profile email and account ID on every install and update event. June07 is the extension developer's own analytics domain.

What it can do

Permissions this extension asks for, as declared in version 3.13.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • Keep running in the background while your browser is open

    background

  • See the address and title of every tab you have open

    tabs

  • Read and change your tab groups

    tabGroups

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

  • Show you desktop notifications

    notifications

  • Add items to the right-click menu

    contextMenus

  • Attach to pages with the browser's debugger, which can read and rewrite anything on them

    debugger

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed NIM contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google-analytics.comwidely used

    NIM sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.

  • analytics.june07.com

    NIM sends data to analytics.june07.com. One other extension we have analysed sends data here.

Updated 30 September 2026gnhhdgbaldcilmgcpfddgdbkhjohddkj