Is Petra Aptos Wallet safe?
Petra is high risk. v2.4.7 removed the exclude_matches list keeping Petra's content script off anti-bot pages (hCaptcha, reCAPTCHA, Arkose, Cloudflare, DataDome, PerimeterX), Stripe iframes, and auth providers. It now runs everywhere; no exfiltration observed.…
Who publishes itAptos Labs - no other listings under this identity, 5 shared hostnames
Aptos Labs - no other listings under this identity, 5 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 5 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Wallet Provider Injected into Captcha and Payment Pages
v2.4.7 removed the exclude_matches list keeping Petra's content script off anti-bot pages (hCaptcha, reCAPTCHA, Arkose, Cloudflare, DataDome, PerimeterX), Stripe iframes, and auth providers.
It now runs everywhere; no exfiltration observed.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You visit any webpage, including captcha challenges, Stripe payment pages, or WalletConnect authentication flows.
The content script runs at document_start on all frames because all_frames is true and no exclude_matches entries remain.
The wallet content script injects inpage.js into the page, making the Petra wallet provider (window.aptos) available in every frame.
In prior versions this injection was skipped for 23 domains including captcha, payment, and auth providers; that filter no longer exists.
content_scripts manifest entry: v2.4.7 (current, no exclusions) vs v2.4.2 (with 23 excluded origins)
v2.4.2 — 23 origins excluded from injection
manifest.json{ "matches": ["<all_urls>"], "exclude_matches": [ "*://*.arkoselabs.com/*", "*://*.challenge.cloudflare.com/*", "*://*.cloudflare.com/*", "*://*.cloudflareinsights.com/*", "*://*.datadome.co/*", "*://*.fastly.com/*", "*://*.hcaptcha.com/*", "*://*.perimeterx.net/*", "*://*.recaptcha.net/*", "*://*/captcha/*", "*://*/cdn-cgi/*", "*://challenges.cloudflare.com/*", "*://client-api.arkoselabs.com/*", "*://hcaptcha.com/*", "*://js.stripe.com/*", "*://recaptcha.net/*", "*://register.walletconnect.com/*", "*://secure.walletconnect.com/*", "*://verify.walletconnect.com/*", "*://*/cdn-cgi/challenge-platform/*", "*://auth.magic.link/*", "*://www.google.com/recaptcha/*", "*://www.gstatic.com/recaptcha/*" ], "js": ["static/js/contentscript.js"], "all_frames": true, "run_at": "document_start"}- *.hcaptcha.com / hcaptcha.com
hCaptcha anti-bot challenge iframes; wallet provider now injected during bot-detection sessions
- *.arkoselabs.com / client-api.arkoselabs.com
Arkose Labs (FunCaptcha) bot-detection service; wallet provider now active in challenge frames
- challenges.cloudflare.com / *.cloudflare.com
Cloudflare Turnstile / challenge page; wallet provider now present during Cloudflare bot checks
- *.recaptcha.net / www.google.com/recaptcha / www.gstatic.com/recaptcha
Google reCAPTCHA challenge frames; wallet provider now injected into CAPTCHA iframes
- js.stripe.com
Stripe payment element JavaScript; wallet provider now runs alongside payment input iframes
- auth.magic.link
Magic Link authentication provider; wallet provider now active in auth flow frames
- register.walletconnect.com / secure.walletconnect.com / verify.walletconnect.com
WalletConnect authentication and verification endpoints; wallet provider now injected during WalletConnect auth flows
- *.datadome.co / *.perimeterx.net / *.fastly.com
DataDome, PerimeterX, and Fastly bot-detection services; wallet provider now present in challenge contexts