The extension sends Spotify credentials to Spotify's own official login servers as part of the standard sign-in process. This is exactly how Spotify's authentication is supposed to work and matches the extension's purpose as a Spotify controller. No credentials are sent to any third-party or unexpected destination.
Technical evidence
Scanner reason: OpenGrep matched static-analysis rule tavernkeeper.credential-exfiltration.javascript-secret-to-network. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
The extension fetches music data from Spotify and a local plugin, and also updates on-screen elements. These are separate activities that don't feed into each other in a dangerous way—network data never becomes executable code. This is normal behavior for a music player widget.
Technical evidence
Scanner reason: JavaScript analysis matched static JavaScript security signal javascript.download-to-execution. The match applies to this repository.
Contextual assessment: Detailed technical wording was omitted by the public report safety filter.
Credential access and network transmission in one file
Expected behavior · high confidence
The file that stores Spotify login tokens also makes network requests, but every request goes to Spotify's official servers or the local media plugin. This is normal for a music player that needs to authenticate with Spotify and control playback. No tokens are leaked to any unexpected location.
Technical evidence
Scanner reason: A credential source and an outbound network operation were detected in the same file.
Contextual assessment: The scanner flags that credential access (settings.accessToken, settings.refreshToken, settings.clientId) and outbound network calls coexist in the same file. Reviewing the actual data flow: access tokens are sent as Bearer headers only to api.spotify.com endpoints for player state and control; refresh tokens and client_id are sent only to accounts.spotify.com for token refresh; and local MPRIS plugin calls to /api/plugins/mpris/* use getRequestHeaders() without transmitting Spotify credentials. All credential-to-network flows target exclusively Spotify's official API domains, which is the expected and correct behavior for an extension whose stated purpose includes optional Spotify API control. No exfiltration to third-party endpoints, logging of credentials, or transmission to unauthorized destinations is present.