Is Ninja Connect Network safe?

Medium risk

Ninja Connect Network sends the URL of each non-LinkedIn page it can see to mymosttrusted.net, with your profile ID.

This LinkedIn networking tool reads your LinkedIn cookies and session token and talks to its own backend for messaging, circles and notifications. When a tab finishes loading and its URL is visible to the extension (hosts such as Google Meet, Zoom and Microsoft sites), the extension posts that URL and your profile ID to mymosttrusted.net.

My Most Trusted Networkv0.0.0.2Chrome Web Store
49Risk
Who publishes it

My Most Trusted Network - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
My Most Trusted Network

Same store account

2 other listings published from this account, 68 users between them, none of them carrying a finding.

Referral Machine Connect42LowElevated Expert Collective26Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Ninja Connect sends each loaded non-LinkedIn page URL to mymosttrusted.net

Code analysis shows the extension posts the address of each non-LinkedIn page it can read to mymosttrusted.net, with your profile id.

The check runs on every completed page load.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open a page on a site the extension can read, such as a Google Meet or Zoom page.

The extension did this

The extension posts that page's address and your profile id to mymosttrusted.net.

The code that does this

The tab listener that calls the detect-link endpoint

Readable version

Listener body

background.js
if ("complete" == a.status && (n || chrome.tabs.sendMessage(e, {          script: "MMTWLNINJACONNECTContentLoader",          method: "initiate",          args: ["callback"]        }, null, (e => {})), t?.url && -1 == t?.url?.search(/linkedin.com/gm))) {        var {          url: c        } = t;        self.callBackEnd("-v5/detect-link", "POST", {          url: c        }, (e => {}), !0)      }
The code that does this

The request wrapper adds the profile id and a trustee header

Readable version
background.js
t.v = chrome.runtime.getManifest().version, t.app = chrome.runtime.getManifest().name, t && !t.profile_id && (t.profile_id = c)...headers: { Accept: n || "application/json", "Content-Type": "application/json", trustee: c || t.profile_id || "" }...fetch("https://mymosttrusted.net/api" + e, l)
Request body and header for the detect-link POST
  • Page URL
    https://meet.google.com/abc-defg-hij

    The full address of the page you just loaded.

  • Profile id
    profile_id from storage (value varies per user)

    Your account id in the extension, sent in the body and a trustee header.

  • App and version
    Ninja Connect Network, 0.0.0.2

    The extension name and version.

Destination
    • mymosttrusted.net

    Receives the page URL and profile id at /api-v5/detect-link.

Observation

The manifest declares no tabs permission, so tab URLs are readable only on hosts in host_permissions, such as meet.google.com, zoom.us and microsoft.com. Not observed at runtime.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Ninja Connect Network contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • mymosttrusted.netwidely used

    Ninja Connect Network sends data to mymosttrusted.net. A widely used service: 39 other extensions we have analysed send data here.

Updated 15 October 2026cdlmndbgcifelofpjmjjjgpdjcapiani