Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Convert Files For Me

CRITICAL RISKRemoved from Chrome Web Store

Convert Files For Me

ID: ipieahghnfclahfpgajdencdajlbeoal

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

2.4001.2.5

Size

0.30 MB

Rating

3.7/5

Reviews

Users

23,793

Type

Extension

Updated

Nov 30, 2022

Publisher Contextual Analysis

Trusted

Author: https://www.convertfilesforme.comView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

23,793

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Convert Files For Me

Quickly Convert Files In One Click! 1. Select files you have 2. Choose the new type of file you would like to create 3. Click 'Convert Files' That's it - your files will be ready in seconds! List of supported file formats: - Image - Document - Video - Music - Archive - E-book Add the ConvertFilesForMe extension to your browser and keep converter at the tip of your fingers at all times!

User Growth

Showing data from Mar 01, 2023 to Oct 26, 2023

Versions

+0.49%(+116 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 3 ratings

Average Rating

Current: 3.67 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High6

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.4001.2.5 Code review	11

Extension Version	Code Review Findings
2.4001.2.5	11

Files with findings

3 distinct paths — top paths by unique finding count:

background.js9
manifest.json1
uid.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 15760)	Builds a per-event payload that captures the full current page URL (`document.location.href`, including query strings which often contain tokens) and the page referrer, plus a server-issued userId, and forwards it to …	2.4001.2.5
2	Remote Code Loading	critical	background.js (line 2870)	On a recurring alarm (configurationPollFrequency, every ~20 min) the worker POSTs the install fingerprint (userId, ticket, version, cwsId, enablePromos) to `configURL` (regulations.convertfilesforme.com/unsound) and a…	2.4001.2.5
3	Tracking	critical	uid.js (line 144)	Content script declared with `run_at: document_start` and `all_frames: true` matching `http(s):///` — i.e. injected into every frame of every page the user visits — exposes the extension's per-user UID to any web pa…	2.4001.2.5
4	Data Exfiltration	high	background.js (line 9452)	Tracking events are base64-encoded (`btoa(JSON.stringify(invalid_l_html))`) and shipped via `fetch` POST or `navigator.sendBeacon` to the trackingUrl. Use of base64 + Content-Type 'application/base64' obscures the pay…	2.4001.2.5
5	Obfuscation	high	manifest.json (line 29)	Manifest declares two universal content scripts (every http/https URL) with the UID-bridge running at `document_start` in `all_frames` so it beats page scripts to the postMessage listener. The bundle ships `uid.js` bu…	2.4001.2.5
6	Obfuscation	high	background.js (line 20245)	All outbound payload schemas are wrapped in a key-renaming map that translates meaningful field names (`pageLocation`, `userId`, `extensionId`, `pageReferrer`, etc.) into deliberately nonsense dotted tokens (`overall.…	2.4001.2.5
7	Privilege Escalation	high	background.js (line 18475)	Opens an arbitrary URL supplied by the remote config (`CONFIG.BANNER_URL`) in a new tab, gated only by a 60-second post-install wait. Combined with the C2 config endpoint above, the operator can force every installed …	2.4001.2.5
8	Unauthorized Data Collection	high	background.js (line 5082)	Hard-coded constellation of remote endpoints used by the extension as a covert telemetry/command-and-control surface: configURL (remote-controlled behavior), trackingUrl (page-visit reporting), acttrUrl (activity repo…	2.4001.2.5
9	Unauthorized Data Collection	high	background.js (line 651)	Posts the user's uid + ticket + installEvent to the operator-controlled `cookiesDataUrl` and stores the JSON response under a 'cookiesData' key in extension storage (see ranked_i/lower_lazy_root call chain). A 'cookie…	2.4001.2.5
10	Obfuscation	medium	background.js (line 682)	The bundle is heavily padded with thousands of always-false dead-code guards comparing `localStorage[<random key>]` or `browser.storage.local.get(<key>)` to random string literals. These branches contain real-looking …	2.4001.2.5
11	Tracking	medium	background.js (line 19582)	Calls `chrome.runtime.setUninstallURL` with a URL containing a per-user log parameter (`uninstallURL: "https://www.convertfilesforme.com/cnvffm/log_deactivate?log="`). On uninstall the browser navigates the user to th…	2.4001.2.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fonts.gstatic.com	-	https://fonts.gstatic.com
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Roboto:wght@300&display=swap
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.convertfilesforme.com	/linchpin	https://www.convertfilesforme.com/linchpin?intone=
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	https:///
*	/*	http:///
www.convertfilesforme.com	-	https://www.convertfilesforme.com
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Open+Sans&display=swap
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Poppins&display=swap

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.7 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

Need to open a WEB PAGE to initiate the conversion for files on my Chromebook...then it downloads a zip file instead of a JPG. too many extra steps....removing.

Dennis Pike·7 Feb 2023

excelente

katty colmenares·19 Jan 2023

excelente

Dixie Houppert·19 Jan 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Convert Files For Me

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating