Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: AI Email Writer

CRITICAL RISKRemoved from Chrome Web Store

AI Email Writer

ID: lnlamplmmdhjapjopfeomjolhffklpfb

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.1.2

Size

3.38 MB

Rating

0.0/5

Reviews

Users

Type

Extension

Updated

Jan 14, 2023

Publisher Contextual Analysis

Author: https://emailwriter.ioView Profile
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

World’s first google chrome plug-in for an AI email writer.

If you're like most people, you probably have a love-hate relationship with email. You love the convenience of being able to communicate with anyone in the world instantly, but you hate the never-ending stream of messages in your inbox. But what if there was a way to use AI to reduce the amount of time you spend on email every day? Email Writer is an AI-powered email writer that can generate emails on your behalf based on provided subject lines. This can be a great way to save time on simple tasks like sending out a monthly newsletter or responding to customer inquiries. Our proprietary email writing software and algorithm takes your daily email writing from being mundane and makes it into a fun exercise by automatically generating email content on any subject of your choice within seconds. You even have the freedom of editing it using our in built paraphrasing and grammar tools.

User Growth

Showing data from Jan 13, 2023 to Jan 24, 2024

Versions

-50%(-1 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium3

Low1

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.1 Code review	8

Extension Version	Code Review Findings
1.1.1	8

Files with findings

3 distinct paths — top paths by unique finding count:

content.js5
manifest.json2
background.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	high	background.js (line 21)	The extension obtains a Google OAuth access token via chrome.identity, persists it in chrome.storage.sync (key `gToken`), and funnels the resulting userinfo into a content-script handler that posts it to a third-party…	1.1.1
2	Privilege Escalation	high	manifest.json (line 11)	The manifest requests full Google Drive and Google Documents read/write OAuth scopes for an extension that only composes Gmail emails. These scopes grant the extension (and its backend manuscripts.ai) the ability to r…	1.1.1
3	Privilege Escalation	high	manifest.json (line 36)	Host permission `:///` grants access to every site the user visits, even though the content_scripts entry only targets `.google.com/*`. Combined with the `scripting` permission and the background.js `chrome.script…	1.1.1
4	Unauthorized Data Collection	high	content.js (line 510)	Every piece of text the user types in a Gmail compose editor is transmitted verbatim to grammarcheck.manuscripts.ai via a GET query parameter. Email draft contents (which can contain personal, financial, or confidenti…	1.1.1
5	Code Injection	medium	content.js (line 382)	Server-returned HTML from pythonservice.manuscripts.ai/ai-editor is written directly into the Gmail compose editor via `innerHTML` with no sanitization. If the third-party backend were compromised or an attacker were …	1.1.1
6	Code Injection	medium	content.js (line 539)	The grammar-check server's response (`output.matches`) is interpolated into an HTML string that is later assigned via `el.innerHTML = nH;`. The attributes and matched text come from attacker-controllable network input…	1.1.1
7	Unauthorized Data Collection	medium	content.js (line 64)	The Google account email, full name, Google user-ID (`sub`), and profile picture URL are exfiltrated to the third-party endpoint api.manuscripts.ai/v1/auth/register_google without any user-facing consent dialog beyond…	1.1.1
8	Obfuscation	low	content.js (line 420)	Base64-encoded/URI-escaped JSON payloads are stored in DOM `data-value` attributes and then decoded with `atob` + `decodeURIComponent(escape(...))` and `JSON.parse`. This encoding layer is unusual for legitimate data …	1.1.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.googleapis.com	/auth/userinfo.profile	https://www.googleapis.com/auth/userinfo.profile
*.manuscripts.ai	/*	https://.manuscripts.ai/
pythonservice.manuscripts.ai	/*	https://pythonservice.manuscripts.ai/*
*.google.com	/*;	https://.google.com/;
api.manuscripts.ai	/api/	https://api.manuscripts.ai/api/
phpapi.manuscripts.ai	-	https://phpapi.manuscripts.ai/
pythonservice.manuscripts.ai	-	https://pythonservice.manuscripts.ai/
manuscripts.thrivecart.com	/email-writer/	https://manuscripts.thrivecart.com/email-writer/?passthrough[customer_firstname
grammarcheck.manuscripts.ai	/v2/check	https://grammarcheck.manuscripts.ai/v2/check?language=en-US&text=${encodeURIComponent(el.innerText

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

AI Email Writer

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating