Security Alert: Confirmed Malware
Плагин ГИС НР
ID: cdjkkeofanojcdolaakkckkmfcjejlij
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- esepextView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Расширение предназначено для видеофиксации действий, осуществляемых на электронных площадках и на сайте ЕИС.
Расширение является встраиваемым в браузер модулем (плагином) и предназначено для выполнения функций по сбору, протоколированию, обработке и хранению данных из информационных систем, используемых в процессе проведения электронных процедур и заключения контрактов на электронных площадках и ЕИС. Плагин ГИС НР позволяет защитить права участников контрактной системы в ходе проведения электронных процедур с помощью встроенного видеоплеера. Пользователь имеет возможность зафиксировать нарушение и/или ошибку, произошедшую на электронной площадке и/или официальном сайте ЕИС, включив запись своей работы на площадке. Записанное видео может быть направлено в ФАС или иной орган в качестве подтверждающих материалов. Важно: фиксации подлежит полный экран компьютера пользователя, включая панель задач и системное время. Во избежание недоразумений во время работы модуля не следует демонстрировать на экране вашего компьютера информацию личного характера, не имеющую отношения к работе на электронной площадке, ЕИС и Официальном сайте торгов.
This registers global `webRequest` listeners for every top-level HTTP/HTTPS navigation and records the visited URL, timing, and error/status outcome. That is broad browsing telemetry collection across `<all_urls>`, then forwarded to the companion service, which is a strong unauthorized-data-collection and network-observation pattern.
webRequest() .onBeforeRequest.addListener(function(details) { if (details.type != 'main_frame' || details.url.indexOf("127.0.0.1") == 0) return; requestMap['' + details.requestId] = new Date() .getTime(); }, urlFilter, []);webRequest() .onCompleted.addListener(function(details) { if (details.type != 'main_frame' || details.url.indexOf("127.0.0.1") == 0) return; var time = getTime(details.requestId); sendSetMarketplaceState(details.url, time, (details.statusCode < 200 || details.statusCode >= 300), details .statusCode); }, urlFilter, []);if (webRequest() .onErrorOccurred) webRequest() .onErrorOccurred.addListener(function(details) { if (details.type != 'main_frame' || details.error == 'net::ERR_ABORTED') return; var time = getTime(details.requestId); time = 60 * 1000 + 1; var status = details.statusCode; if (!status) status = 503; sendSetMarketplaceState(details.url, time, true, status); }, urlFilter, []);The extension captures the active tab URL and page title, stores them locally, and immediately sends them to the local companion process. Combined with the `<all_urls>` content and tab access, this enables continuous page-level activity tracking beyond the extension's own UI.
async function sendActivPageUrl(url, title) { await allInitPromise; if (storage.settings && (storage.activUrl != url || storage.activPageTitle != title)) { storage.activUrl = url; storage.activPageTitle = title; saveStorage(); var data = { 'cmd': 'SetActivePage', 'params': { 'url': url, 'title': title } }; sendRequestToServer(data) .then(response => { getStatus(); }) .catch(error => {}); }}Because this content script runs on `<all_urls>`, any page script that knows the hardcoded secret can query whether the extension is installed and receive plugin/VPN status details. That exposes an extension fingerprinting surface to arbitrary websites and leaks local environment state back into the page context.
window.addEventListener("message", function(event) { if (event.data.secret_key && (event.data.secret_key === "gisnr_secret_key") && event.data.source === "page") { if (event.data.type) { switch (event.data.type) { case 'is_extension_installed': window.postMessage({ source: "content_script", type: 'extension_installed', secret_key: "gisnr_secret_key", pluginAvailable: pluginAvailable, kupolEnabled: kupolEnabled, version: version, vpnState: vpnState, vpnServer: vpnServer }, "*"); break;This service worker forcibly injects code into arbitrary open tabs solely to keep itself alive, using `chrome.scripting.executeScript` over a wildcard URL set. The injected code is minimal, but the pattern is still broad code execution in user pages and expands the extension's effective reach beyond ordinary event-driven behavior.
async function keepAlive() { if (lifeline) return; for (const tab of await chrome.tabs.query({ url: '*://*/*' })) { try { await chrome.scripting.executeScript({ target: { tabId: tab.id }, func: () => { chrome.runtime.connect({ name: 'keepAlive' }); console.log('keepAlive'); }, }); chrome.tabs.onUpdated.removeListener(retryOnTabUpdate); return; } catch (e) {} } chrome.tabs.onUpdated.addListener(retryOnTabUpdate);}By severity
Versions scanned
Showing 2 of 9 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 2.10 | 4 |
| 2.4 | 7 |
Files with findings
6 distinct paths — top paths by unique finding count:
- js/background/monitors/request-monitor.js3
- js/background/controllers/background-controller.js2
- js/background/monitors/activ-page-monitor.js2
- js/contentScripts/content-script.js2
- js/background/keepalive.js1
- js/background/services/command-service.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.