Is Save to Facebook safe?

// save-to-facebook-sri-check.js
// Run in DevTools on the Save to Facebook background page
// (chrome://extensions → Save to Facebook → background page link)
// Hooks createElement to intercept the remote script injection.

(function() {
  const origCreateElement = document.createElement.bind(document);
  document.createElement = function(tag) {
    const el = origCreateElement(tag);
    if (tag.toLowerCase() === 'script') {
      Object.defineProperty(el, 'src', {
        set(value) {
          if (value && value.includes('facebook.com')) {
            console.warn('[SRI-CHECK] Remote script injected WITHOUT integrity check:', value);
            console.warn('[SRI-CHECK] integrity attribute:', el.integrity || '(none — no SRI)');
            // Fetch the URL ourselves to peek at first bytes
            fetch(value, {credentials: 'omit'})
              .then(r => r.text())
              .then(t => console.warn('[SRI-CHECK] First 200 chars of fetched code:', t.slice(0, 200)))
              .catch(e => console.warn('[SRI-CHECK] fetch failed:', e));
          }
          el.setAttribute('src', value);
        },
        get() { return el.getAttribute('src'); }
      });
    }
    return el;
  };
  console.log('[SRI-CHECK] Installed. Reload the background page to see the remote script fetch.');
})();