Renamed to VirusTotal Sidekick. Previously "Download Link VirusTotal Checker". Same intended use, shorter name.

Right-click no longer fetches silently. A confirmation page now opens first, showing the exact URL about to be downloaded. Nothing leaves your browser until you click Check. This avoids accidental hits on one-time download tokens, pre-signed URLs, and links with tracking side effects.

The "Upload File for Analysis" button is fixed. In the previous version, it wasn't working due to a missing message handler. Files that aren't recognized by hash can now be uploaded directly to VirusTotal from the extension.

URLs are no longer submitted to VirusTotal. Previously, when a hash wasn't found, the original URL was sent to VirusTotal's URL-scan API, where it became publicly searchable. This could expose tokens or signatures embedded in download URLs. The extension now uploads the file's bytes instead.

Other improvements

• The extension no longer requests broad "access your data for all websites" permission on install. The host permission is now optional; Firefox prompts you for each new host the first time you check a link from it.
• Uploads are sent with a fixed generic filename. Earlier drafts used the URL's last path segment, which could contain object IDs or other identifiers; that information is no longer included.
• The link you click and the final URL after any redirects are both checked against a private-network blocklist. Links that resolve to localhost, RFC1918 ranges, link-local addresses including cloud metadata endpoints, or other reserved space are rejected. URLs containing embedded credentials are also rejected.
• File downloads omit cookies, so authenticated sessions are not sent with the request.
• Recent lookup results are cached locally for 24 hours to save API quota.
• The API key field in options is now a password input, hidden by default.
• File size limit corrected from 200 MB to 32 MB (VirusTotal's public API cap).
• Streaming size check, so oversized files no longer load fully into memory before being rejected.
• All network requests now have timeouts.
• Non-HTTP(S) links (file://, data:, etc.) are rejected before any fetch.
• API key format is validated on save.
• Blocking alert() popups replaced with browser notifications.
• Network policy tightened so the extension can only talk to virustotal.com.

The background script has been rewritten in async/await, and the unused URL-scan progress page has been removed.

Small fixes and improvements.