Is Pixelay for Figma safe?
Pixelay for Figma can remove CSP and X-Frame-Options headers from HTTPS pages after its content script is triggered.
When a page is on pixelay.hypermatic.com or has a pixelay_project_id query parameter, the content script asks the background worker to install a session rule. That rule removes Content-Security-Policy and X-Frame-Options response headers from HTTPS main frames and subframes, which changes browser protections for those pages.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itHypermatic - no other listings under this identity
Hypermatic - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 1.1.11. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.1.13, which we have not unpacked yet.
Read and change your data on every site you visit
<all_urls>
Block and redirect the requests your browser makes
declarativeNetRequest