Chrome Web StoreNo malware found
In code review (v1.0.8)
Our reviewer read version 1.0.8 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.
187 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Billfish - Free material management tool, used by 40,000 people, showed no malicious code in Extension Auditor's review. Our code review reported 2 findings (2 high), led by remote code loading. Its permissions mean it can inject scripts into pages and can observe network requests.
Key findings
- High
Remote Code Loading
The `convertSrc` function uses `eval` to execute dynamically generated code from the ` ` rules. This file can be updated remotely from the attacker-controlled CDN (`[domain withheld]). If the CDN is compromised or the developer pushes a malicious rule, arbitrary JavaScript can be executed in the extension's background context, granting full access to all permissions (<all_urls>, etc.). This constitutes a remote code execution vulnerability.
- High
Other
The bundled uses `manifest_version` 2 and does not include the `webRequest` or `scripting` permissions, while the published CWS listing summary indicates `manifest_version` 3 with `webRequest` and `scripting` in permissions. This discrepancy may indicate a version mismatch or a later update; it should be reviewed to ensure no unauthorized permission changes have occurred.
Analyst notes
The extension's core behavior—capturing images from web pages and sending them to a local Billfish desktop app via localhost—is consistent with its stated purpose as a material management tool. Broad host permissions and content script injection are necessary for image saving across sites. The use of `eval` with remotely updatable rules is a serious vulnerability (remote code execution) but appears to be a poor design choice rather than intentional malware. Analytics (Sensorsdata) sends usage data but does not track browsing history. Manifest version mismatch with the live listing may be due to a later update. Overall, no active exfiltration or malicious activity was found.
Billfish - Free material management tool Chrome extension security report
ID: piohkopmiebhgodfkcfcmjbmgkcnjnmf
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- billfishchina
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- Yes
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
187 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Quickly and easily manage your design materials-so you have more time to focus on the design itself.
Read the publisher’s full description
Help users quickly get web page pictures through the browser
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
187 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
Popular in Workflow & Planning
- Adobe Acrobat: PDF edit, convert, sign tools345,000,000 users
- Application Launcher For Drive (by Google)99,000,000 users
- AdBlock — block ads across the web64,000,000 users
- Chrome Remote Desktop41,000,000 users
- Adblock Plus - free ad blocker40,000,000 users