Is Taho safe?

Medium risk

Taho is medium risk. Taho sends PostHog analytics after onboarding, including Analytics Toggled and Chain Added events keyed to a persistent UUID. The shipped SW enables analytics by default on first run and sends dApp connection events with the site's origin.

Taho Doggosv0.67.1Chrome Web Store
45Risk
Who publishes it

Taho Doggos - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Taho Doggos

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Taho sends wallet analytics to PostHog by default

MediumunwantedCWE-359Dynamic sandbox

Taho sends PostHog analytics after onboarding, including Analytics Toggled and Chain Added events keyed to a persistent UUID.

What actually happens

You did this

You install and start using the wallet extension.

Connecting a dApp or adding a chain creates wallet activity for the background service.

The extension did this

The extension sends analytics events to PostHog with a persistent identifier.

The source shows dApp connection events include the connected site's origin and chain ID.

Fields assembled for PostHog analytics events

  • Persistent analytics ID
    8ef5023a-6f40-4d3a-bf0f-2ef8f2d91fb9 (illustrative; observed value began 8ef5023a)

    Lets the analytics service link multiple wallet events from the same browser profile over time.

  • Event name
    Chain Added

    Shows what wallet action happened, such as toggling analytics or adding a chain.

  • Connected dApp origin
    https://app.uniswap.org (illustrative dApp origin)

    Shows which web application your wallet connection was granted to.

  • Chain ID
    1

    Shows which blockchain network the wallet action was associated with.

  • PostHog project key
    phc_<redacted>

    Routes the analytics event into Taho's PostHog project.

Captured request

POSThttps://app.posthog.com/capture/

Dynamic analysis observed PostHog capture POSTs for Analytics Toggled and Chain Added events; the evidence text did not record a full request body.

Headers
Accept
application/json
Content-Type
application/json

The code that does this

The service worker enables analytics, builds the payload, and emits dApp connection events

Readable version

Payload builder and POST request

deobfuscated/background.js:123004-123031
function shouldSendPosthogEvents() {  return !!"phc_<redacted>";}function createPosthogPayload(personUUID, eventName, payload) {  return JSON.stringify({    uuid: esm_browser_v4(),    distinct_id: personUUID,    api_key: "phc_<redacted>",    event: eventName,    timestamp: (new Date).toISOString(),    properties: {      $lib: USE_ANALYTICS_SOURCE,      $current_url: typeof window !== "undefined" ? window.location.href : "service-worker",      ...payload    }  });}function sendPosthogEvent(personUUID, eventName, payload) {  try {    if (shouldSendPosthogEvents()) {      fetch(POSTHOG_URL, {        method: "POST",        body: createPosthogPayload(personUUID, eventName, payload),        headers: {          "Content-Type": "application/json",          Accept: "application/json"        }      });    }  } catch (e) {    lib_logger.debug("Sending analytics event failed with error: ", e);  }}

First-run analytics default

deobfuscated/background.js:123131-123151
async internalStartService() {  await super.internalStartService();  const {uuid, isNew} = await this.getOrCreateAnalyticsUUID();  let {isEnabled, hasDefaultOnBeenTurnedOn} = await this.preferenceService.getAnalyticsPreferences();  if (!hasDefaultOnBeenTurnedOn) {    isEnabled = true;    hasDefaultOnBeenTurnedOn = true;    await this.preferenceService.updateAnalyticsPreferences({      isEnabled,      hasDefaultOnBeenTurnedOn    });    await this.emitter.emit("enableDefaultOn", undefined);  }  if (isEnabled) {    browser_polyfill_default().runtime.setUninstallURL(false ? 0 : `${"https://taho.xyz"}/goodbye?uuid=${uuid}`);    if (isNew) {      await this.sendAnalyticsEvent(AnalyticsEvent.NEW_INSTALL);    }  }  this.#analyticsUUID = uuid;}

dApp permission analytics event

deobfuscated/background.js:128675-128686
dapp_emitter.on("grantPermission", (async permission => {  this.analyticsService.sendAnalyticsEvent(AnalyticsEvent.DAPP_CONNECTED, {    origin: permission.origin,    chainId: permission.chainID  });  await Promise.all(this.chainService.supportedNetworks.map((async network => {    await this.providerBridgeService.grantPermission({      ...permission,      chainID: network.chainID    });  })));}));

External destinations used by this analytics path

    • app.posthog.com

    Receives wallet analytics capture events for Taho's PostHog project.

    • taho.xyz

    Receives the uninstall URL callback with the persistent analytics UUID when Chrome opens the uninstall survey URL.

Updated 15 October 2026eajafomhmkipbjmfmhebemolkcicgfmd