Who makes Stylus (beta)?

Stylus (beta) is published by stylus.openstyles. The same operator publishes 1 other store listing, none of which carry a security finding.

What servers does Stylus (beta) send data to?

Our analysis observed Stylus (beta) sending data to oauth2.googleapis.com, login.microsoftonline.com and userstyles.world.

Am I Being Pwned?

Log in Get started

Is Stylus (beta) safe?

Q: Is Stylus (beta) safe?

Stylus (beta) is low risk. The rating reflects signals from our analysis that have not yet been published as detailed findings.

Low risk

Stylus (beta) applies user-authored CSS styles to websites and includes hardcoded OAuth client secrets for optional cloud sync providers.

Stylus (beta) is an open-source browser extension that injects custom CSS into web pages at the user's direction, allowing visual customization of any site. It supports optional style synchronization via Google Drive, OneDrive, Dropbox, or UserStylesWorld using bundled OAuth credentials. The OAuth client secrets for these providers are embedded directly in the extension bundle rather than fetched at runtime.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

stylus.openstylesv3.4.17Chrome Web Store

15Risk

Who publishes it

stylus.openstyles - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

stylus.openstyles

Website

github.com/openstyles/stylus/wiki

Same store account

1 other listing published from this account, 1.0M+ users between them, none of them carrying a finding.

Stylus1.0M+Clean

Shared hosts - 11 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

33kk.github.io

Also called by 1 other listing: Stylus

clngdbkpkpeebahjckkjfobafhncgmne.chromiumapp.org

Also called by 1 other listing: Stylus

gusted.xyz

Also called by 1 other listing: Stylus

explore.transifex.com

Also called by 2 other listings: Stylus, ScratchTools

update.userstyles.org

Also called by 2 other listings

uso.kkx.one

Also called by 2 other listings, including FireMonkey

gateway.userstyles.org

Also called by 3 other listings, including Stylish

sleazyfork.org

Also called by 3 other listings, including FireMonkey, Magic Userscript+

stylus-lang.com

Also called by 4 other listings, including FireMonkey

stylelint.io

Also called by 5 other listings, including xStyle

userstyles.world

Also called by 5 other listings, including FireMonkey

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Where it sends data

Destinations our analysis observed Stylus (beta) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

oauth2.googleapis.com
Stylus (beta) sends data to oauth2.googleapis.com. 13 other extensions we have analyzed send data here.
login.microsoftonline.com
Stylus (beta) sends data to login.microsoftonline.com. 8 other extensions we have analyzed send data here.
userstyles.world
Stylus (beta) sends data to userstyles.world. One other extension we have analyzed sends data here.