Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
buttercup-browser-extension
Advanced tools
Buttercup browser extension for Chrome and Firefox.
Buttercup credentials manager extension for the browser.
This browser extension allows users to interface with password archives authored by the Buttercup password manager (though it does not require the application to be installed).
The extension can remotely connect to archives via Buttercup's common communication protocols (WebDAV, Dropbox etc.). Vaults are loaded from their remote source and their contents used to assist users with logging in to their recorded services. The extension also periodically updates vaults from their remote source so that the contents are always up to date.
This extension uses Locust to perform login form detection. Issues relating to the detection and operation of login forms should be opened there.
The extension also comes with a full-featured vault editing interface, so you can even use it as a standalone password manager.
Buttercup for Browsers auto-detects some login forms and login inputs, allowing the user to auto-fill them at their discretion. This extension uses Locust under the hood to detect forms and inputs (any issues with detecting forms and inputs should be opened there).
Chrome, Firefox, Edge (version 79+) and Brave are supported.
Some browsers, such as Brave for example, will be able to install Buttercup via the Google Chrome web store.
Other browsers will be supported in order of request/popularity. Issues created for unsupported browsers, or for browsers not on the roadmap, may be closed without warning.
Opera is not supported due to their incredibly slow and unreliable release process. We will not be adding support for Opera.
The extension allows for connections to several services where your vaults can be stored:
The browsers listed above, running on Windows, Mac or Linux on a desktop platform. This extension is not supported on any mobile or tablet devices.
The browser extension can be controlled from the popup menu, which is launched by pressing the Buttercup button in the browser menu. This menu displays a list of archives as well as settings and other items.
When viewing pages that contain login forms, Buttercup can assist logging in when you interact with the login buttons (displayed beside detected login inputs).
Buttercup can also remember new logins, which are detected as they occur.
You can block Buttercup from detecting forms and inputs by applying the attribute data-bcupignore=true
:
<input type="email" data-bcupignore="true" />
Development of features and bugfixes is supported in the following environment:
To set up your development environment:
npm install
inside the project directoryRun the following to develop the extension:
npm run dev
to build and watch the project (to build production code, execute npm run build
)./dist
directory built on step 1Run the following to develop the extension:
npm run dev:firefox
to build and watch the project (to build production code, execute npm run release
)To build release-ready zip archives, run the command npm run release
after having set up the development environment. The archives will be written to release/(browser)
where (browser)
is the browser type. Archives named extension.zip
contain the built extension sourcecode and source.zip
contains the raw source.
You can load an unpacked extension in Chrome by navigating to chrome://extensions/. Simply locate the project's directory and use dist/ as the extension directory.
You can load an unpacked extension in Firefox by navigating to about:debugging. Click "Load Temporary Add-on" and locate the project's directory, using dist/ as the extension directory.
FAQs
Buttercup browser extension for Chrome and Firefox.
We found that buttercup-browser-extension demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.