Security Warning: Historically Flagged as Malware
BTS Cursor ★ Custom Cursor for Chrome™
ID: jddaakabhmcbgfnbkgcjfeigbnbcdjgn
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://owhit.comView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Browse with 60+ BTS cursors featuring RM, Jin, SUGA, j-hope, Jimin, V & Jungkook!
BTS Cursor ★ Custom Cursor for Chrome™ lets you bring the energy and charm of BTS right to your browser! 🖱️💜 Enjoy browsing with 60+ stunning custom cursors featuring BTS members: RM, Jin, SUGA, j-hope, Jimin, V, and Jungkook. 🔹 Features 💜 60+ Unique Cursors – Includes all seven BTS members in different poses, outfits, and styles. ⭐ Favorites System – Save and access your most-used cursors anytime. 📏 Adjustable Size – Choose cursor sizes from 16px to 128px. ⚡ One-Click Switch – Instantly activate any cursor with a single click. 🔘 Enable/Disable Toggle – Easily turn custom cursors on or off. 🚀 Lightweight & Fast – Optimized for smooth performance without slowing your browser. 🎯 Why Choose BTS Cursor? 🧩 Customization – Show your BTS love and make your browser uniquely yours. 🎤 Fan Power – Enjoy every click with visuals inspired by RM, Jin, SUGA, j-hope, Jimin, V, and Jungkook. 🖥️ Simple Interface – Clean and easy-to-use cursor switch panel. 👩🎨 Fan-Made Design – Created by ARMYs, for ARMYs. 📌 Note: This extension is not affiliated with HYBE, BigHit Music, or the official BTS brand. All content is fan-made.
On install, the extension opens a tab to yowgames.com with UTM tracking parameters (utm_source=install), and registers an uninstall URL to the same domain with utm_source=Uninstall. This silently signals the third-party domain of both install and uninstall events, enabling covert user lifecycle tracking without the user's knowledge or consent.
chrome.runtime.onInstalled.addListener(function(details) { if (details.reason === "install") { chrome.storage.local.set({ switch_status: "true", default_cursor: "", pointer_cursor: "", default_cursor_result: "", pointer_cursor_result: "", default_curSize: "48", pointer_curSize: "48", favorites: [] }); // Kurulum sonrası hoş geldiniz sayfasını aç chrome.tabs.create({ url: "https://yowgames.com/bts-cursor-%e2%98%85-custom-cursor-for-chrome/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install" }); }});// Uzantı kaldırıldığında çalışacakchrome.runtime.setUninstallURL( "https://yowgames.com/bts-cursor-%e2%98%85-custom-cursor-for-chrome/?utm_source=Uninstall&utm_medium=link&utm_campaign=bg&utm_content=Uninstall");The extension dynamically injects a CSS style element into every page's document.head using values from chrome.storage that are interpolated directly into a template literal without sanitization. While the values are currently data URLs generated by the extension itself, an attacker who can write to chrome.storage could inject arbitrary CSS content into all browsed pages, enabling CSS-based data exfiltration (e.g., using attribute selectors to send form field values via url() requests). The style id also references 'demonslayer-impact-cursor-style' rather than the BTS theme, suggesting code reuse from a different extension.
// Yeni stil oluşturcursorStyle = document.createElement('style');cursorStyle.id = 'demonslayer-impact-cursor-style';cursorStyle.textContent = ` * { cursor: url(${data.default_cursor_result}), auto !important; } a, button, input[type="submit"], input[type="button"], .btn, [role="button"], [type="button"], [type="reset"], [type="submit"], [type="checkbox"], [type="radio"], select, option, .clickable, .pointer, [onclick], [data-action], [data-click], [data-toggle] { cursor: url(${data.pointer_cursor_result || data.default_cursor_result}), pointer !important; } `;The content script is injected into every frame (all_frames:true) on every HTTP and HTTPS URL at document_start, before any page content loads. This is the maximum possible injection scope and timing, which is unusual for a cursor styling extension that only needs to modify cursor CSS. Running at document_start on all frames including sensitive iframes (payment processors, authentication, email clients) gives the extension early access to each page's DOM before security-sensitive content is rendered.
{ "content_scripts": [ { "all_frames": true, "js": [ "cursorcontent.js" ], "matches": [ "*://*/*" ], "run_at": "document_start" } ]}A MutationObserver is registered on document.documentElement with subtree:true, monitoring all DOM changes across the entire page tree. While it appears to filter on IFRAME/FRAME additions, the callback receives every mutation batch first. Combined with the all_frames:true content script running at document_start on all URLs, this creates a persistent DOM surveillance surface on every page and frame the user visits, including sensitive ones like banking or email.
// Sayfadaki dinamik değişiklikleri izle ve cursor'u tekrar uygulaconst observer = new MutationObserver(function(mutations) { // Sadece önemli DOM değişikliklerinde cursor'u tekrar uygula if (mutations.some(mutation => mutation.type === 'childList' && (mutation.addedNodes.length > 0 || mutation.removedNodes.length > 0) && Array.from(mutation.addedNodes) .some(node => node.nodeName === 'IFRAME' || node.nodeName === 'FRAME') )) { if (cursorData) { applyCursor(cursorData); } }});// DOM değişikliklerini izlemeye başlaobserver.observe(document.documentElement, { childList: true, subtree: true});The popup loads a font directly from Google's servers rather than bundling it locally. Every time a user opens the extension popup, a network request is sent to fonts.googleapis.com, allowing Google to log the event and correlate it with the user's IP and browser fingerprint. This is an unnecessary external dependency that leaks popup-usage telemetry to a third party.
<link href="https://fonts.googleapis.com/css2?family=Nunito:wght@400;600;700&display=swap" rel="stylesheet">By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.01.05 | 5 |
Files with findings
4 distinct paths — top paths by unique finding count:
- cursorcontent.js2
- cursorbackground.js1
- cursorpopup.html1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.