Audio Equalizer

A message handler responds to an externally-triggerable 'getUid' method by returning the user's persistent unique identifier. Critically, it also increments a usage counter and, after 100 invocations, sets a 'valid' flag to 1 — a classic time-bomb anti-detection pattern that delays activation of suspicious behavior past sandbox/review thresholds. The 'getUid' method is never sent by any visible internal code in the extension, indicating it is intended to be triggered by an external party (e.g., a remote script or injected page) to harvest the persistent user UID and eventually unlock a dormant payload via the 'valid' flag.

chrome.runtime.onMessage.addListener(function(obj, sender, sendResponse) {      if (obj.method && obj.method == "getUid") {        if (Core.load("count")) {          let co = Core.load("count");          let count = parseInt(co);          count++;          Core.save('count', count);          if (count > 100) {            Core.save('valid', 1)          }        } else {          Core.save('count', 1);        }        return sendResponse({          uid: Core.load('uid')        });      }

The manifest explicitly weakens the default Content Security Policy by including 'unsafe-eval', allowing the extension to execute dynamically-generated code via eval(), new Function(), setTimeout(string), etc. A legitimate audio equalizer has no need for eval()-based code execution. This deliberate CSP weakening is a common precaution taken by malicious extensions to ensure their dynamic payload injection works even if other defenses are in place.

{  "content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"}

When the popup is opened and no audio stream is currently active, the extension automatically initiates tab audio capture (via 'powerOn') without any explicit user interaction — no button press required. Combined with the broad '<all_urls>' and '*://*/*' permissions plus 'tabCapture', this means every popup open silently starts capturing audio from the active tab (including banking, corporate, or sensitive sites). This auto-capture behavior is undisclosed to the user and constitutes covert audio surveillance.

chrome.tabs.query({  active: true,  currentWindow: true}, function(a) {  if (Core.load('power') == true) {    // ... existing stream handling ...  } else {    chrome.runtime.getBackgroundPage(function(bg) {      if ("undefined" === typeof bg.currentTab.stream) {        Core.save('id', a[0].id);        Core.sendMessage("powerOn", a[0]);        Power.visualOn(a[0])      }    })  }});

On installation, the extension silently generates and persists a unique user ID (via getUserID() which creates a UUID) alongside the install timestamp in chrome.storage.local. On updates, it also records the update timestamp. This fingerprinting infrastructure is the foundation for the covert user tracking system exposed by the 'getUid' message handler, enabling long-term identification of individual users across sessions.

chrome.runtime.onInstalled.addListener(function(details) {  if (details.reason == "install") {    Core.save('tabEqualizer', true);    chrome.storage.local.set({      userId: Core.getUserID(),      dateInstalled: (new Date()).getTime(),      tabEqualizer: true,      mono: false,      instance: false,      power: false,      pitch: false,      info: true,      tabLimiter: false,      convolverBypass: true,    });  } else if (details.reason == "update") {    chrome.storage.local.set({      dateUpdate: (new Date()).getTime()    })  }});

The extension generates a cryptographically random UUID and stores it persistently in localStorage as 'uid'. This persistent identifier is then saved to chrome.storage.local as 'userId' at install time and is returned to external callers via the 'getUid' message handler. The UID survives browser restarts and extension updates, functioning as a permanent user fingerprint for covert cross-session tracking.

getUserID() {  let uid = this.load('uid');  if (uid) {    return uid;  } else {    let buf = new Uint32Array(4),      idx = -1;    window.crypto.getRandomValues(buf);    uid = 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, function(c) {      idx++;      let r = (buf[idx >> 3] >> ((idx % 8) * 4)) & 15,        v = c == 'x' ? r : (r & 0x3 | 0x8);      return v.toString(16);    }.bind(this));    this.save('uid', uid);    return uid;  }}