I'm using TorBrowser 7.0.10 on macOS 10.12.6. I have "Little Flocker" application installed which warns me every time an App is trying to access some file. Every time I start TorBrowser I get the warning about the following application is trying to access the following file:

Filename: /Users/XXX/Library/Application Support/TorBrowser-Data/Browser/pdf1dcp3.default/extension/{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

Application path: /Applications/TorBrowser.app/Contents/MacOS/plugin-container.app/Contents/MacOS/plugin-container (1146)

Codesign Identity: Developer ID Application: The Tor Project, Inc (MADPSAYN6T)

This warning survived multiple TorBrowser updates.

I tried both allowing and denying this file access with Little Flocker. I can't tell what's the difference in consequent browsing experience.

Is this normal behavior or sign of a bug or malware presence? Shell I allow this file access forever?

On a side note: is there a way I can attach images (screenshots for example) and other files to my posts here?

Thanks for helping out. Cheers!


Yes, this is normal.

The .xpi file extension is the format for Firefox/Mozilla extensions.

The .xpi file is a .zip file which contains resources for the extension, normally just some javascript/html/css files and other resources it might need, like image files.

In this case, {73a6fe31-595d-460b-a920-fcc0f8843232}.xpi is the NoScript extension that is bundled with Tor Browser. The file is extracted from the .app on installation to the user profile under ~/Library/Application Support/TorBrowser-Data/.

It's not an indicator of malware or any malicious activity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.