Phantom

What This Extension Does

Permissions Explained

• activeTab: Allows the extension to access the currently active tab in the browser.
• alarms: Enables the extension to schedule background tasks or notifications.
• identity: Grants the extension access to user identity information, such as login credentials and profile data. This is unusual for a crypto wallet extension, which typically doesn't require direct access to user identities.
• storage: Allows the extension to store and retrieve data locally on the user's device.
• scripting: Enables the extension to execute scripts in the browser context.
• tabs: Grants the extension access to tab management functionality, such as creating new tabs or switching between existing ones.
• unlimitedStorage: Allows the extension to store an unlimited amount of data locally on the user's device. This is unusual for a Chrome extension and may indicate that the extension stores sensitive user data.
• webRequest: Enables the extension to intercept and modify web requests made by the browser.
• sidePanel: Grants the extension access to display a panel in the browser sidebar.

What We Found in the Code

• [high] Function constructor used — dynamic code execution: This is a normal coding pattern for creating objects dynamically. It doesn't necessarily indicate malicious behavior.
• [medium] innerHTML assignment — potential XSS vector: While innerHTML can be used to inject malicious scripts, it's also commonly used for legitimate UI rendering purposes. Without more context, it's difficult to determine if this is a security concern.
• [info] Makes HTTP requests: This is a normal behavior for extensions that need to communicate with external services or APIs.
• [high] Listens to keyboard events: This can be used for legitimate purposes such as implementing shortcuts or hotkeys. However, it may also indicate an attempt to intercept sensitive user input.
• [medium] Reads clipboard content: This is a normal behavior for extensions that need to interact with the user's clipboard data.
• [medium] Potential data exfiltration pattern: Without more context, it's difficult to determine if this flag indicates malicious behavior. However, it may indicate an attempt to transmit sensitive user data outside of the extension.

External Connections

• www.w3.org: A standard domain for web development resources.
• github.com: A common domain for hosting open-source projects and code repositories.
• www.apache.org: A standard domain for Apache software projects.
• react.dev: A domain related to React.js, a popular JavaScript library.
• sola.na: An unknown domain that may be related to the extension's functionality.
• help.phantom.com: A domain likely related to the extension's support resources.
• feross.org: A domain related to Feross Aboukhadijeh's projects and blog.
• developer.mozilla.org: A standard domain for Mozilla developer documentation.
• assets.phantom.app, node-proxy.phantom.app, phantom.com: Domains likely related to the extension's functionality or infrastructure.
• cdn.jsdelivr.net: A content delivery network (CDN) used to distribute assets.

Things to Consider

• The identity permission may not be required for a crypto wallet extension.
• The unlimitedStorage permission is unusual for a Chrome extension and may indicate that the extension stores sensitive user data.
• The webRequest permission may be used to intercept or modify web requests, which could potentially compromise user security.