Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Blitz Smart Card Plugin

CRITICAL RISKRemoved from Chrome Web Store

Blitz Smart Card Plugin

ID: pomekhchngaooffdadfjnghfkaeipoba

Could be malicious

Supported Languages

🇺🇸English

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

2.3.0.1

Size

0.09 MB

Rating

2.8/5

Reviews

Users

400,000

Type

Extension

Updated

Dec 24, 2024

Publisher Contextual Analysis

Author: https://identityblitz.ruView Profile
Help: Help Center
Country: Россия
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: Суворовская улица, дом 19А Москва 107023 Россия
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

400,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Extension for use with Blitz Smart Card Plugin

To use the Blitz Smart Card Plugin in the Google Chrome browser you need to install a special extension - Blitz Smart Card Plugin adapter. Blitz Smart Card Plugin allows you to use different types of electronic signatures, including the Aladdin eToken / JaCarta PKI, Rutoken ECP, CryptoPro CSP 3.9 / 4.0, ESMART and SafeNet eToken tokens (list of devices depends on the operating system). See the list of supported keys on the developer's page.

User Growth

Showing data from Jan 01, 2022 to Jan 01, 2023

Versions

-42.86%(-300,000 users)

Compared to 4 months ago

3 versions released in this period

Rating Count

Total: 19 ratings

Average Rating

Current: 2.53 / 5.0+0.14

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High5

Medium2

Low0

Versions scanned

Showing 2 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.9.4 Code review	3
1.1.8 Code review	7

Extension Version	Code Review Findings
1.1.9.4	3
1.1.8	7

Files with findings

4 distinct paths — top paths by unique finding count:

content.js4
background.js3
firewyrm.js2
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	firewyrm.js (line 196)	The `browser` object exposed to the native messaging host explicitly registers an `eval` function that executes arbitrary JavaScript strings passed from the native host. Because the native host communicates over `nati…	1.1.8
2	Code Injection	critical	content.js (line 9)	Any script running in the page can send a `postMessage` with `firebreath: 'Reaxoft'` and a `callback` property to trigger `initPage`. The `firebreathId` value `'Reaxoft'` is a hardcoded, publicly visible constant, so …	1.1.8
3	Privilege Escalation	critical	background.js (line 45)	The background page opens a native messaging connection using a host name taken from the connecting port name, then blindly proxies messages in both directions. Because the host name is ultimately page-controlled thro…	1.1.9.4
4	Code Injection	high	firewyrm.js (line 260)	This library explicitly exposes `eval`, `getDocument`, and `getWindow` helpers to the FireWyrm browser bridge. In the context of the extension's unrestricted page-to-native messaging channel, that means native-side in…	1.1.9.4
5	Code Injection	high	content.js (line 113)	The `injectScript` function inserts arbitrary JavaScript text as a `<script>` node directly into the live page DOM. This bypasses the content script isolation sandbox entirely, executing code in the full page context …	1.1.8
6	Privilege Escalation	high	content.js (line 9)	This content script runs on `<all_urls>` at `document_start` and accepts `window.postMessage` traffic directly from the page, then forwards page-supplied messages into extension ports. That creates a privileged bridge…	1.1.9.4
7	Privilege Escalation	high	background.js (line 42)	The background script extracts the native host application name directly from the port connection name (`scriptPort.name.split('\|')[1]`), which is set by the page-side code. This means any web page that can communicat…	1.1.8
8	Unauthorized Data Collection	high	background.js (line 23)	On first installation, the extension immediately injects `content.js` into every currently open tab in the user's window using `chrome.tabs.executeScript` without any URL filtering or user interaction. This means the …	1.1.8
9	Data Exfiltration	medium	content.js (line 50)	All messages relayed from the native host back to the page are broadcast with `window.postMessage(msg, "*")`, specifying no target origin. This means any cross-origin iframe embedded in the same page receives every me…	1.1.8
10	Unauthorized Data Collection	medium	manifest.json (line 19)	The content script runs at `document_start` (before any page HTML parses) on `<all_urls>` in `all_frames: true`, giving it the earliest possible execution on every URL in every iframe on every site. Combined with `web…	1.1.8

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


vuejs.org	/error-reference/	https://vuejs.org/error-reference/#runtime-${type}`;
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	https:///

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.0.0	IPv4	-
2.3.0.1	IPv4	-

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Explore new opportunities with us to increase revenue and expand your chrome extension. See how we can help you. Details at: https://extensionbuysell.com We are looking forward to working with you! Best regards,

Kieran Godfrey·23 Sept 2024

Hello, I hope you're having a splendid day! I am currently seeking opportunities to expand my business operations by investing in extensions with a significant user base, beginning from 20,000 users and up. No matter if your extension has a modest user base or counts its users in the millions, I am interested and ready to negotiate a purchase. If you are in possession of such an extension and looking to turn it into a profit, please consider reaching out to me. We can discuss the price and proceed with a transparent and secure transaction through a trusted escrow service based in the United States. It's great that Google allows the transfer of extension ownership between accounts, so your Google account ownership will remain intact. If you have any needs, please contact us via the following contacts Whatsapp: +1 (248) 896‑8035 Telegram: t.me/harryysandersonn

Ethan Marshall·12 Aug 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Blitz Smart Card Plugin

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating