Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 网易有道词典鼠标取词插件

CRITICAL RISKRemoved from Chrome Web Store

网易有道词典鼠标取词插件

ID: aohddidmgooofkgohkbkaohadkolgejj

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.5.2

Size

0.03 MB

Rating

2.5/5

Reviews

817

Users

151,109

Type

Extension

Updated

Sep 3, 2020

Publisher Contextual Analysis

Author: http://cidian.youdao.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

151,109

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

支持网易有道词典在浏览器中实现鼠标取词

在安装了网易有道词典客户端的Windows电脑上，安装该插件后能在浏览器中更快更精准得取词。

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High5

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.5.2 Code review	7

Extension Version	Code Review Findings
2.5.2	7

Files with findings

2 distinct paths — top paths by unique finding count:

background.js4
lookup.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 227)	The `checkSetting` function parses command strings received from the native host (`com.youdao.cidian.text_extractor_host`) or from a local file (`flg.txt`). When the command `GETWORD` is received, the extension immedi…	2.5.2
2	Data Exfiltration	high	background.js (line 251)	All text captured from every webpage is transmitted as plaintext URL parameters to a local HTTP service on port 50000. The `browserName` value (sourced from native messaging responses) is appended to every request as …	2.5.2
3	Privilege Escalation	high	background.js (line 71)	The extension establishes a persistent native messaging channel to `com.youdao.cidian.text_extractor_host`, a native binary installed on the user's system. The native host can send arbitrary `timestamp` strings that a…	2.5.2
4	Unauthorized Data Collection	high	lookup.js (line 5)	The content script registers mouse event listeners on every page (matched against http://* and https://*) and captures the raw DOM text node at the cursor position up to 300 characters and transmits it to the backgrou…	2.5.2
5	Unauthorized Data Collection	high	lookup.js (line 85)	On every mouse-up (drag-select) and double-click event across all websites, up to 2000 characters of selected text is extracted from `document.getSelection()` and sent to the background script. Additionally, the selec…	2.5.2
6	Unauthorized Data Collection	high	lookup.js (line 17)	This content script runs on every HTTP/HTTPS page and extracts text directly from the DOM at the mouse cursor position when triggered. Sending arbitrary page text and offsets from all sites to the background script is…	2.5.2
7	Other	medium	background.js (line 6)	A synchronous (blocking) XHR utility is defined and available in the background page. Synchronous XHR in extensions is deprecated and abusable: it can be used to make blocking network calls to arbitrary URLs (includin…	2.5.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	/word=	http://127.0.0.1:50000/word=
127.0.0.1	/word=test&heartbeating=true&	http://127.0.0.1:50000/word=test&heartbeating=true&
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-

2.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

win10 的chrome上不可以使用

薛

薛鹏飞念·26 Dec 2020

win10 的chrome上不可��使用

薛

薛鹏飞念·26 Dec 2020

内存泄漏问题非常厉害，开5个不到的标签页，放半小时我8G内存就占完了

雷

雷驰·13 Dec 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

网易有道词典鼠标取词插件

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews