Is Octohint safe?
Octohint sends package names from code-host pages to jsDelivr to look up TypeScript definitions.
When you click or move the mouse over code on GitHub, Gist, GitLab, or Bitbucket, Octohint reads the visible code block and passes it to its background worker. The worker parses import, export-from, and require package names, then requests package metadata or type-definition files from cdn.jsdelivr.net; the claim indicates the full source code remains inside the extension.
Who publishes itRongjian Zhang - 1 other listing from the same operator, none carrying a finding
Rongjian Zhang - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 10k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Octohint contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- cdn.jsdelivr.netwidely used
Octohint sends data to cdn.jsdelivr.net. A widely used service: 32 other extensions we have analysed send data here.