Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Copy Link Text

CRITICAL RISKRemoved from Chrome Web Store

Copy Link Text

ID: loeniidbmeohdlmipbpkfmiogbcncibh

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

3.0.3

Size

0.29 MB

Rating

3.3/5

Reviews

Users

30,000

Type

Extension

Updated

Apr 16, 2024

Publisher Contextual Analysis

Trusted

Author: vestakuphal285View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

30,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Copies the text inside links

Allows you to copy the text of a link in the context menu and save the link. Just right click on the link and select "Copy link text". Update version: 3.0.2 - Fix errors and save links to easily manage and find links at: https://www.facebook.com/saved Update version: 3.0.1 - Added copy text link history management feature, can review, export txt file and delete log history.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-2.13%(-654 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 63 ratings+1 (2%)

Average Rating

Current: 3.22 / 5.0-0.13

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High2

Medium1

Low0

Versions scanned

Showing 1 of 6 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.0.2 Code review	5

Extension Version	Code Review Findings
3.0.2	5

Files with findings

1 distinct path — top paths by unique finding count:

static/js/background.js5

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	static/js/background.js (line 4348)	The background worker silently fetches https://m.facebook.com/composer/ocelot/async_loader/ with the user's authenticated cookies (credentials: 'include') and scrapes the user's Facebook ACCOUNT_ID and fb_dtsg CSRF to…	3.0.2
2	Network Interception	critical	static/js/background.js (line 4279)	The extension uses declarativeNetRequest to silently rewrite the Origin and Referer headers of background XHRs to https://www.facebook.com / https://m.facebook.com. This is a classic CSRF-bypass technique: Facebook's …	3.0.2
3	Privilege Escalation	high	static/js/background.js (line 4389)	Using the previously harvested userId + fb_dtsg, the extension issues authenticated POSTs to Facebook's internal /save/extension/v2/ endpoint on behalf of the signed-in user. Combined with the spoofed Origin/Referer r…	3.0.2
4	Unauthorized Data Collection	high	static/js/background.js (line 4498)	Authenticated POST to Facebook's internal webgraphql endpoint that reads payload.data.viewer.saver_info.save_lists — i.e. it enumerates the victim's private Facebook 'Saved' collections using their cookies + fb_dtsg. …	3.0.2
5	Unauthorized Data Collection	medium	static/js/background.js (line 4378)	Strips Facebook's 'for (;;);' JSON-hijack guard prefix before JSON.parse — a small but telling helper that only exists in code that scrapes Facebook's internal logged-in JSON APIs. It corroborates that the surrounding…	3.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
npms.io	/search	https://npms.io/search?q=ponyfill.
copylinktext.com	-	https://copylinktext.com
www.facebook.com	-	https://www.facebook.com
m.facebook.com	-	https://m.facebook.com
www.facebook.com	/save/extension/v2/	https://www.facebook.com/save/extension/v2/?object_url=
www.facebook.com	/save/extension/v2/	https://www.facebook.com/save/extension/v2/?
www.facebook.com	/webgraphql/query/	https://www.facebook.com/webgraphql/query/?doc_id=4869457273138521&variables=%7B%22object_id%22%3A%22
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.2.3.4	IPv4	-
1:2:3:4:5:6:7:8	IPv6	-

3.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

It is not working Chrome Version 125.0.6422.78 (Official Build) (64-bit)

JY XX (JY)·27 May 2024

Open the offline .html in the browser, just like those saved by SingleFile, "copy link text" does not take effect, hope it can be improved

Vii Leo·20 May 2024

didn't work properly

FF T.C.G Gamer·14 May 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Copy Link Text

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 6 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating