Backpack

What This Extension Does

Permissions Explained

• storage: Allows the extension to store data locally on the user's device.
• unlimitedStorage: Grants the extension permission to use an unlimited amount of storage space on the user's device. This is unusual for a typical extension and may indicate that the extension requires significant storage capacity.
• background: Enables the extension to run in the background, allowing it to perform tasks without being actively used by the user.
• sidePanel: Allows the extension to display a panel or sidebar within the browser.
• declarativeNetRequest: Grants the extension permission to modify network requests made by the browser. This is unusual for a typical wallet extension and may indicate that the extension is intercepting or modifying web traffic in some way.
• https://twitter.com/*, https://x.com/*, https://connect.trezor.io/*: These permissions allow the extension to access specific websites or APIs directly from within the browser. This is unusual for a typical wallet extension and may indicate that the extension requires direct access to these services.

What We Found in the Code

• [high] eval() used — can execute arbitrary code: The use of eval() is generally considered a security risk, as it allows execution of arbitrary code. However, without more context, it's difficult to determine if this is being used maliciously or for legitimate purposes.
• [medium] innerHTML assignment — potential XSS vector: Assigning innerHTML can be a potential cross-site scripting (XSS) vulnerability if untrusted data is being inserted into the DOM. However, in many cases, innerHTML is used for UI rendering and may not pose an actual risk.
• [info] Makes HTTP requests: The extension makes HTTP requests to various domains, which is a normal behavior for any web application or extension that interacts with external services.
• [high] Listens to keyboard events: Listening to keyboard events can be used for legitimate purposes such as implementing shortcuts. However, without more context, it's difficult to determine if this is being used maliciously.

External Connections

• backpack-shared-assets.s3.us-east-1.amazonaws.com: This domain appears to be a storage bucket for shared assets related to the extension.
• www.w3.org, eips.ethereum.org, and eu.support.backpack.exchange are likely used for documentation, API access, or support purposes.
• github.com may indicate that the extension uses GitHub APIs or services.
• Other domains (t.me, blockaid.xnftdata.com, 0x.xnfts.dev, etc.) appear to be related to cryptocurrency or blockchain services.

Things to Consider