Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Βase Pro Wallet

CRITICAL RISKRemoved from Chrome Web Store

Βase Pro Wallet

ID: pijphekphpccokjmkdmlihpmddhoocnb

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

3.1.27

Size

6.26 MB

Rating

0.0/5

Reviews

Users

189

Type

Extension

Updated

Dec 31, 2025

Publisher Contextual Analysis

Author: ViburaziView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

189

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Βase Pro Wallet is a Βase network crypto wallets that supports ETH, BNB, SOL, and TRX.

User Growth

Showing data from Dec 22, 2025 to Feb 08, 2026

Versions

No change in user count

Compared to 2 months ago

2 versions released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High1

Medium0

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.1.27 Code review	4

Extension Version	Code Review Findings
3.1.27	4

Files with findings

4 distinct paths — top paths by unique finding count:

js/background.js1
manifest.json1
vendors/1223.js1
vendors/775.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/background.js (line 52)	Registers js/inpage.js in the MAIN execution world (not the isolated extension world) on every page at document_start. Running in MAIN world gives direct access to page JavaScript globals including window.ethereum and…	3.1.27
2	Data Exfiltration	critical	vendors/1223.js (line 1)	String-array rotation obfuscation hides a C2 exfiltration call. Decoded: on chrome.runtime.onStartup, the script reads chrome.storage.local['DataAnalytics'] and POSTs its contents to https://c9r4j6.adata.lol/api/analy…	3.1.27
3	Phishing	critical	manifest.json (line 5)	The extension name uses Unicode Greek capital Beta (Β, U+0392) in place of Latin B to visually impersonate the Base blockchain network — this homoglyph substitution is a documented phishing technique. Content scripts …	3.1.27
4	Obfuscation	high	vendors/775.js (line 762)	The underlying UI codebase renders 'TokenPocket Extension Wallet' — confirming this extension is a wholesale clone of the legitimate TokenPocket wallet with the branding name swapped via the manifest. Packaging a well…	3.1.27

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

577

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/

Showing 1 to 10 of 580 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.3.132.0	IPv4	-
1.101.3.4	IPv4	-
127.0.0.1	IPv4	-
51.141.78.53	IPv4	-
13.93.54.137	IPv4	-
94.237.54.114	IPv4	-
18.218.250.66	IPv4	-
3.11.147.67	IPv4	-
51.15.116.226	IPv4	-
51.15.119.157	IPv4	-
116.203.116.241	IPv4	-
3.217.96.11	IPv4	-
108.61.170.124	IPv4	-
157.230.31.163	IPv4	-
18.138.108.67	IPv4	-
3.209.45.79	IPv4	-
34.255.23.113	IPv4	-
35.158.244.151	IPv4	-
52.187.207.27	IPv4	-
191.234.162.198	IPv4	-
52.231.165.108	IPv4	-
104.42.217.25	IPv4	-
52.169.42.101	IPv4	-
52.3.158.184	IPv4	-
159.89.28.211	IPv4	-
52.176.7.10	IPv4	-
52.176.100.77	IPv4	-
52.232.243.152	IPv4	-
192.81.208.223	IPv4	-

Showing 1 to 29 of 30 rows

Rows per page:

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Βase Pro Wallet

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions4

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating