Is SparxSolver safe?
SparxSolver is medium risk. Every service worker wake opens an offscreen document that registers your browser with a third party AI compute network and sends a hardware fingerprint. We captured a live registration request; neither the listing nor the UI mention it.
Who publishes itNajm Ajmal - no other listings under this identity
Najm Ajmal - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
SparxSolver turns your browser into an AI compute node without asking first
Every service worker wake opens an offscreen document that registers your browser with a third party AI compute network and sends a hardware fingerprint.
We captured a live registration request; neither the listing nor the UI mention it.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install, update, or restart the browser, which wakes the extension's background service worker.
background.js opens a chrome.offscreen document that loads a bundled SDK, fingerprints your device, and registers it with a third party AI compute network with no consent prompt.
background.js: unconditional call, no opt-in gate
The top level initializer that fires on every wake
background.js// 2. Main Top-Level Initialization (Fires instantly on every single wake-up)(async () => { // Initialize Mellowtel try { mellowtel = new Mellowtel(MELLOWTEL_CONFIG_KEY); await mellowtel.initBackground(); console.log('🛡️ Mellowtel: Background initialized successfully.'); } catch (error) { console.error('❌ Mellowtel: Initialization failed:', error); } // Force ZeroGPU setup immediately await setupZeroGpuOffscreen();})();offscreen.js loads the ZeroGPU SDK with a hardcoded key
offscreen.jsimport { initZeroGpuOffscreen } from "./vendor/zerogpu/zerogpu-offscreen.js";console.log("ZeroGPU Offscreen initialization sequence started!");initZeroGpuOffscreen({ edgeOperatorKey: "<redacted, hardcoded vendor SDK key shipped in the extension>", enableConsoleLogs: false,});- Device IDb7e2f9a0-4c31-4e2a-9f6d-1a2b3c4d5e6f
A UUID the SDK generates and stores in your browser so ZeroGPU can recognize this device across sessions.
- GPU rendererANGLE (Apple, Apple M2, OpenGL 4.1)
Your graphics card name, read through WebGL, used to decide which AI models this device can run.
- CPU cores & RAMcpuCores: 8, memoryGb: 8
Your processor core count and device memory, used to size the compute job assigned to this device.
- Screen & battery1512x982 @2x, battery 87% charging
Your screen resolution, pixel ratio, and battery charge and charging state.
- Network & timezonewifi, 10.6 Mbps down, Australia/Sydney
Your connection type and speed plus your timezone, sent with every registration.
Response assigns a WebSocket URL (wsUrl) the offscreen document connects to for server assigned inference jobs.
- Content-Type
- application/json
- x-edge-operator-key
- <redacted, hardcoded vendor SDK key>
{ "deviceId": "b7e2f9a0-4c31-4e2a-9f6d-1a2b3c4d5e6f", "sdkVersion": "0.1.6+9f0db3f", "device": { "sdkDeviceId": "b7e2f9a0-4c31-4e2a-9f6d-1a2b3c4d5e6f", "platform": "macos-web", "deviceType": "desktop", "cpuCores": 8, "memoryGb": 8, "gpuRenderer": "ANGLE (Apple, Apple M2, OpenGL 4.1)", "screen": { "width": 1512, "height": 982, "pixelRatio": 2 }, "battery": { "level": 0.87, "charging": true }, "connection": { "type": "wifi", "downlink": 10.6, "rtt": 40 }, "timezone": "Australia/Sydney", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" }}- devices.zerogpu.ai
Receives the device fingerprint and issues a WebSocket URL used to assign remote AI inference jobs to this device's CPU/GPU.
- wsUrl (server assigned WebSocket)
The endpoint the offscreen document connects to after registration, used to receive and execute inference jobs.
The SDK also has code for navigator.geolocation and getUserMedia camera capture, gated by server response flags rather than shipped code. Both were off in our session; the operator could enable them remotely without a new release.