Redux Devtools
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Blocks application state changes and provides debugging tools for Redux applications, letting developers inspect and manage their store's state in real-time. Most beneficial to Redux developers and teams who need to debug complex state changes, this extension offers a comprehensive solution for managing application state. Benefits developers with large-scale Redux projects or those new to the framework.
Overview
The extension provides power-ups for your Redux development workflow. Apart from Redux, it can be used with any other architectures which handle the state.
This is an open source project. See the official repository for more details: https://github.com/reduxjs/redux-devtools
Tags
Privacy Practices
Security Analysis — Redux Devtools
Permissions
Code Patterns Detected
External Connections
Package Contents 29 files · 3.5MB
What This Extension Does
Redux DevTools is a debugging extension for Redux applications, allowing developers to inspect state changes. It's suitable for developers working with Redux-based projects.
Permissions Explained
- notificationsexpected: This permission allows the extension to display notifications in the browser.
Technical: The extension can access the chrome.notifications API, which enables it to send notifications to the user. This could be used for legitimate purposes such as alerting the user about important events or errors. - contextMenusexpected: This permission allows the extension to create custom context menu items in the browser.
Technical: The extension can access the chrome.contextMenus API, which enables it to add custom menu items. This could be used for legitimate purposes such as providing quick actions or options. - storageexpected: This permission allows the extension to read and write data in the browser's storage.
Technical: The extension can access the chrome.storage API, which enables it to store and retrieve data. This could be used for legitimate purposes such as storing user preferences or caching data. - file:///*check this: This permission allows the extension to access local files on the user's device.
Technical: The extension can access file:/// URLs, which enables it to read and write local files. This is a high-risk permission as it could be used for malicious purposes such as stealing sensitive data or installing malware. ⚠ 1 - http://*/*check this: This permission allows the extension to make HTTP requests on behalf of the user.
Technical: The extension can access http:// URLs, which enables it to send HTTP requests. This is a high-risk permission as it could be used for malicious purposes such as sending sensitive data or installing malware. ⚠ 1 - https://*/*check this: This permission allows the extension to make HTTPS requests on behalf of the user.
Technical: The extension can access https:// URLs, which enables it to send HTTPS requests. This is a high-risk permission as it could be used for malicious purposes such as sending sensitive data or installing malware. ⚠ 1
Your Data
The extension accesses the user's storage and can send data to various domains, including GitHub and Redux Toolkit.
Technical Details
Code Findings
The extension uses the Function constructor to execute dynamic code, which could be used for malicious purposes such as injecting malware or stealing sensitive data.
Technical: The extension uses the Function constructor in the background script (background.js) to execute dynamic code. This is a high-risk behavior as it allows the extension to inject arbitrary code into the browser.
💡 This pattern is commonly used for legitimate purposes such as loading scripts or executing user-provided code.
The extension uses innerHTML assignment, which could be used to inject malicious HTML or execute XSS attacks.
Technical: The extension assigns innerHTML in the content script (content.js) to a DOM element. This is a medium-risk behavior as it allows the extension to inject arbitrary HTML into the page.
💡 This pattern is commonly used for legitimate purposes such as loading dynamic content or executing user-provided code.
The extension uses String.fromCharCode to obfuscate code, which could be used for malicious purposes such as hiding malware or stealing sensitive data.
Technical: The extension uses String.fromCharCode in the background script (background.js) to obfuscate code. This is a medium-risk behavior as it allows the extension to hide its true purpose or intentions.
💡 This pattern is commonly used for legitimate purposes such as compressing data or encrypting sensitive information.
The Redux DevTools extension has some concerning permissions and behaviors, including dynamic code execution, innerHTML assignment, and String.fromCharCode obfuscation. While these issues are not necessarily malicious, they do increase the risk of the extension being used for nefarious purposes. Users should exercise caution when installing this extension and ensure that it is only installed from trusted sources.
