Upgrade StorageZotero plugins directory and security check https://zoteroplugins.org/
Hi all,
Something kept bugging me whenever I installed a Zotero plugin: I had no real idea what I was installing. A plugin gets the same access as Zotero itself, so it can read your library and your files and talk to the internet. Mostly I'd grab an .xpi from GitHub and hope for the best.
Then I read about GlassWorm, malware that spread through VS Code extensions via their updates, and about The Great Suspender, a popular Chrome extension that was sold and then turned into malware by its new owner. Both looked perfectly legit at first. That scared me, because Zotero plugins update themselves too.
So I opened up the code of a few plugins I use and found a few issues. That's when I decided to map every Zotero plugin I could find and review them all. It's taken a few months of running checks, going through the results, verifying them by hand, fixing the checks and running everything again.
The result is https://zoteroplugins.org. It has:
* about 1,550 plugins, with the Zotero versions each one works with (and what to use instead of old Zotero 6 plugins like ZotFile)
* a grade for each one based on its code: A when nothing stands out, B when there's something worth reading before you install, C when there's something serious, like code that's deliberately scrambled so nobody can read it
* the evidence behind every finding: the file and line, where the plugin sends your data, whether it needs an API key
* about 600 plugins I also ran in a test copy of Zotero to see what they actually do
The list updates daily, and every new release gets checked, not only the first one.
The good news is that most plugins are fine. About half get an A, and a lot of B's come down to something small, like two links a popular plugin library adds by default. A B doesn't mean "unsafe", it means "have a look at why first".
If you develop a plugin and I got something wrong, please tell me. Every plugin page has an "I'm the developer" link, and your reply shows up right next to the findings. I've fixed plenty of my checks along the way and I'm sure there's more to fix.
It's a hobby project: no ads, no paid listings, and nobody can pay for a better grade. The code and data are on GitHub. The short plugin summaries are written by AI from each README and marked as such; the grades come from the code checks. I know Zotero is planning an official plugin directory, and if any of this is useful for it, the data is open.
Would love to hear what you think, especially if I've missed a plugin or got one wrong.
- Ilias
How the grades work: https://zoteroplugins.org/how-we-grade
Source and data: https://github.com/iliasbeshimov/zoteroplugins.org
Something kept bugging me whenever I installed a Zotero plugin: I had no real idea what I was installing. A plugin gets the same access as Zotero itself, so it can read your library and your files and talk to the internet. Mostly I'd grab an .xpi from GitHub and hope for the best.
Then I read about GlassWorm, malware that spread through VS Code extensions via their updates, and about The Great Suspender, a popular Chrome extension that was sold and then turned into malware by its new owner. Both looked perfectly legit at first. That scared me, because Zotero plugins update themselves too.
So I opened up the code of a few plugins I use and found a few issues. That's when I decided to map every Zotero plugin I could find and review them all. It's taken a few months of running checks, going through the results, verifying them by hand, fixing the checks and running everything again.
The result is https://zoteroplugins.org. It has:
* about 1,550 plugins, with the Zotero versions each one works with (and what to use instead of old Zotero 6 plugins like ZotFile)
* a grade for each one based on its code: A when nothing stands out, B when there's something worth reading before you install, C when there's something serious, like code that's deliberately scrambled so nobody can read it
* the evidence behind every finding: the file and line, where the plugin sends your data, whether it needs an API key
* about 600 plugins I also ran in a test copy of Zotero to see what they actually do
The list updates daily, and every new release gets checked, not only the first one.
The good news is that most plugins are fine. About half get an A, and a lot of B's come down to something small, like two links a popular plugin library adds by default. A B doesn't mean "unsafe", it means "have a look at why first".
If you develop a plugin and I got something wrong, please tell me. Every plugin page has an "I'm the developer" link, and your reply shows up right next to the findings. I've fixed plenty of my checks along the way and I'm sure there's more to fix.
It's a hobby project: no ads, no paid listings, and nobody can pay for a better grade. The code and data are on GitHub. The short plugin summaries are written by AI from each README and marked as such; the grades come from the code checks. I know Zotero is planning an official plugin directory, and if any of this is useful for it, the data is open.
Would love to hear what you think, especially if I've missed a plugin or got one wrong.
- Ilias
How the grades work: https://zoteroplugins.org/how-we-grade
Source and data: https://github.com/iliasbeshimov/zoteroplugins.org