Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Плагин ГИС НР

CRITICAL RISKRemoved from Chrome Web Store

Плагин ГИС НР

ID: cdjkkeofanojcdolaakkckkmfcjejlij

Could be malicious

Supported Languages

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

2.10

Size

0.82 MB

Rating

1.8/5

Reviews

Users

200,000

Type

Extension

Updated

Oct 9, 2024

Publisher Contextual Analysis

Author: esepextView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

200,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Расширение предназначено для видеофиксации действий, осуществляемых на электронных площадках и на сайте ЕИС.

Расширение является встраиваемым в браузер модулем (плагином) и предназначено для выполнения функций по сбору, протоколированию, обработке и хранению данных из информационных систем, используемых в процессе проведения электронных процедур и заключения контрактов на электронных площадках и ЕИС. Плагин ГИС НР позволяет защитить права участников контрактной системы в ходе проведения электронных процедур с помощью встроенного видеоплеера. Пользователь имеет возможность зафиксировать нарушение и/или ошибку, произошедшую на электронной площадке и/или официальном сайте ЕИС, включив запись своей работы на площадке. Записанное видео может быть направлено в ФАС или иной орган в качестве подтверждающих материалов. Важно: фиксации подлежит полный экран компьютера пользователя, включая панель задач и системное время. Во избежание недоразумений во время работы модуля не следует демонстрировать на экране вашего компьютера информацию личного характера, не имеющую отношения к работе на электронной площадке, ЕИС и Официальном сайте торгов.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-60%(-300,000 users)

Compared to 4 months ago

2 versions released in this period

Rating Count

Total: 15 ratings

Average Rating

Current: 1.60 / 5.0+0.20

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High4

Medium6

Low0

Versions scanned

Showing 2 of 9 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.10 Code review	4
2.4 Code review	7

Extension Version	Code Review Findings
2.10	4
2.4	7

Files with findings

6 distinct paths — top paths by unique finding count:

js/background/monitors/request-monitor.js3
js/background/controllers/background-controller.js2
js/background/monitors/activ-page-monitor.js2
js/contentScripts/content-script.js2
js/background/keepalive.js1
js/background/services/command-service.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Unauthorized Data Collection	critical	js/background/monitors/request-monitor.js (line 7)	The extension registers a blocking `webRequest` listener against ALL http and https URLs (`http:///` and `https:///`), intercepts every main-frame navigation, and exfiltrates the full URL, precise load timing, and…	2.4
2	Network Interception	high	js/background/monitors/request-monitor.js (line 38)	This registers global `webRequest` listeners for every top-level HTTP/HTTPS navigation and records the visited URL, timing, and error/status outcome. That is broad browsing telemetry collection across `<all_urls>`, th…	2.10
3	Network Interception	high	js/background/monitors/request-monitor.js (line 52)	The `onBeforeRequest` listener is registered with the `blocking` extra-info spec, meaning the extension can delay or modify every outgoing HTTP/HTTPS request across all websites. Combined with the universal URL filter…	2.4
4	Tracking	high	js/background/monitors/activ-page-monitor.js (line 6)	Every tab activation, tab update, and browser window focus change triggers extraction of the active tab's full URL and page title, which are then transmitted to the local server. This creates a continuous real-time lo…	2.4
5	Unauthorized Data Collection	high	js/background/monitors/activ-page-monitor.js (line 3)	The extension captures the active tab URL and page title, stores them locally, and immediately sends them to the local companion process. Combined with the `<all_urls>` content and tab access, this enables continuous …	2.10
6	Code Injection	medium	js/background/keepalive.js (line 4)	This service worker forcibly injects code into arbitrary open tabs solely to keep itself alive, using `chrome.scripting.executeScript` over a wildcard URL set. The injected code is minimal, but the pattern is still br…	2.10
7	Other	medium	js/background/controllers/background-controller.js (line 91)	The extension exposes its runtime status and version to any external page matching `://localhost/` via `chrome.runtime.onMessageExternal`. Any locally-served web application can query the extension's running state a…	2.4
8	Tracking	medium	js/contentScripts/content-script.js (line 7)	Because this content script runs on `<all_urls>`, any page script that knows the hardcoded secret can query whether the extension is installed and receive plugin/VPN status details. That exposes an extension fingerpri…	2.10
9	Tracking	medium	js/background/controllers/background-controller.js (line 217)	A `PostTelemetry` command that includes the user's current active URL is sent to the local server whenever internet connectivity state, time synchronization state, or marketplace availability changes. This constitutes…	2.4
10	Tracking	medium	js/contentScripts/content-script.js (line 1)	The content script, injected into ALL frames of ALL URLs, listens for `window.postMessage` from any origin and responds using the hardcoded plaintext secret `"gisnr_secret_key"`. Because the secret is embedded in the …	2.4
11	Tracking	medium	js/background/services/command-service.js (line 13)	A unique GUID is generated at service initialization time and appended as `id` to every command sent to the local server. This GUID persists for the lifetime of the background page and acts as a stable per-session ide…	2.4

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

140

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


disk.yandex.ru	-	https://disk.yandex.ru
www.w3.org	/TR/html4/loose.dtd	http://www.w3.org/TR/html4/loose.dtd
zakupki.gov.ru	/epz/main/public/document/view.html	https://zakupki.gov.ru/epz/main/public/document/view.html?sectionId=920
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#

Showing 1 to 10 of 140 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-

4.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Почему постоянно выскакивает "Плагин не доступен"? захожу в него, вроде рабртает

СБ

Сергей Брыксин·3 Dec 2024

Надо же такое придумать полное... разочарование

Олег·7 Oct 2024

We are looking for a partnership to explore new sources of income for chrome extensions. We believe that this partnership can help your business grow stronger. See more at: https://extensionbuysell.com Looking forward to working with you! Best regards,

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Плагин ГИС НР

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 9 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating