Is Notepad++ online safe?
Notepad++ online sends each top-level page URL and the previous URL, hex-encoded, to www.winfy.net.
A background script watches every top-frame navigation and, about once a day, sends the current and previous page URL (hex-encoded) with a persistent random ID to www.winfy.net. It also reports URLs ending in .src or .source, and if the server replies with a specific code it opens a winfy.net tab. This is on by default, can be switched off in the popup, and the listing does not mention history collection.
Who publishes itWinfy - no other listings under this identity
Winfy - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Notepad extension sends every page you open, plus the previous one, to winfy.net
Code analysis shows each top-level page URL and the tab's previous URL are hex-encoded and sent to www.winfy.net with a persistent random ID, at most about once per day.
Not disclosed in the listing.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open any web page in a tab.
Only top-level navigations count; frame loads are skipped.
The page URL and the tab's previous URL are sent to www.winfy.net.
A day-of-month check limits sends to about one per day.
Navigation listener and upload request
Source is unobfuscated; shown as shipped
ws.js// ws.js ships readable. bin2hex(s) returns the charCode of each character as two hex digits, so the URL is trivially recoverable.- filepath68747470733a2f2f6578616d706c652e636f6d2f6163636f756e747c7c7c68747470733a2f2f6578616d706c652e6f72672f
Hex of the current page URL, then '|||', then the previous URL in that tab.
- uk3x9qw7ztp
Persistent random 10-character ID kept in extension storage.
- dx09
Current day of the month, used for the once-per-day gate.
- hex1
Flag telling the server the filepath value is hex-encoded.
The filepath value is plain hex of character codes, not encryption. Illustrative example built from the code's format.
https://example.com/account|||https://example.org/- www.winfy.net
Receives URLs and the persistent ID; reply can trigger a new tab to a winfy.net info page.
Decodes a filepath value from the winfy.net request into the current and previous URL.
- Node.js 18+
const hex = process.argv[2];let s = '';for (let i = 0; i < hex.length; i += 2) s += String.fromCharCode(parseInt(hex.substr(i, 2), 16));const [current, previous] = s.split('|||');console.log({ current, previous });- 1Copy the filepath value from a request to appwfnotepadplusplus.php.
- 2Run: node decode_filepath.js <hex>.
- 3Read the two URLs.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.1.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every secure site you visit
https://*/*
Read and change your data on every site you visit
http://*/*
Store data in your browser
storage
See every page you navigate to, as you navigate to it
webNavigation
Where it sends data
Destinations our analysis observed Notepad++ online contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.winfy.net
Notepad++ online sends data to www.winfy.net. 6 other extensions we have analysed send data here.