SafeAgent

Passive Web3 security extension for Chrome (Manifest V3, TypeScript).

It watches for four common attacks against crypto users and warns before money moves. Detection runs entirely on the user's device: no accounts, no analytics, no data leaves the browser.

• Chrome Web Store: https://chromewebstore.google.com/detail/ofohhhijlkclalcbfckgpinancpdapmh
• Publisher: https://holder.io

Modules

1. Clipboard Swap Guard — detects address substitution in clipboard (passive, no preventDefault).
2. Anti-Drainer — intercepts window.ethereum signatures (setApprovalForAll, approve, permit) and blocks unknown spenders.
3. Seed Phrase Detector — DOM scanner for 12/24-word seed inputs on web pages.
4. Anti-Phishing (URL) — exact blacklist match + Levenshtein typosquatting detection.

Stack

• Manifest V3 (strict CSP, no unsafe-eval).
• TypeScript (strict).
• Vite + @crxjs/vite-plugin.
• Storage: chrome.storage.local (settings, logs, cached DBs) + chrome.storage.session (temp clipboard records, tab status).
• UI on page: isolated closed Shadow DOM.
• Tests: Vitest.

i18n

• 12 UI languages: _locales/{en,ru,de,es,zh,fr,ja,ko,pt,it,tr,vi} (default: en).
• Content-script UI strings: typed dictionary in src/content/l10n/messages.ts.
• Seed-phrase keywords: multilingual in src/data/phishing-keywords.json.

Development

npm install
npm run dev      # Vite + HMR
npm run build    # production build → dist/
npm run typecheck
npm run lint
npm run test

Load dist/ in Chrome via chrome://extensions → "Load unpacked".

Docs

• README/architecture.md — full architecture.
• README/modules.md — module contracts.
• README/threat-vectors.md — top-6 attack vectors coverage matrix.
• README/i18n.md — localization guide.
• README/testing.md — deep test scenarios.

Privacy

The extension processes page URLs, page content, and clipboard text locally to detect threats. It stores settings, a local threat log, and cached threat databases in Chrome extension storage. The only outbound request is a daily download of threat-list updates; no user data is attached to it.

Permissions used: storage, tabs, clipboardRead, alarms, and host access to http/https pages (protection scripts must run wherever an attack can appear).

Security

Detection is heuristic and best-effort — see SECURITY.md for scope, design boundaries, and how to report a vulnerability.

License

MIT — see LICENSE.