Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: CoWIN Bot

CRITICAL RISKRemoved from Chrome Web Store

CoWIN Bot

ID: ipdhilmkmmbfeilncgchfdabkpnhbeog

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.54

Size

0.04 MB

Rating

4.7/5

Reviews

188

Users

164,217

Type

Extension

Updated

Jun 16, 2021

Publisher Contextual Analysis

Author: cowinbotView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

164,217

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

A faster way to get your vaccine slot in India

WARNING: Using this extension for monetary gains is neither encouraged nor permitted. People misusing this extension will be solely liable for legal consequences. By using the extension, you agree to terms and conditions listed here: https://cowin-bot.s3-eu-west-1.amazonaws.com/tnc.html REQUEST: If you find this extension helpful, please consider volunteering to help at least 2 other people who are in urgent need of getting vaccinated and do not have the technical know-how or means (access to mobile devices, laptop, or stable internet connection) to get registered. Use this extension to look for and book vaccination slots on CoWIN, based on your criteria. Steps: 1. Install extension 2. Go to https://selfregistration.cowin.gov.in/ and login with OTP 3. Select beneficiaries and click on Schedule Now to move to the search page 4. Once on the search page, open this extension, fill the form and Submit That's it! You get all the controls, on how frequently you want to run and for what criteria - use it wisely! In case the bot is stuck or behaves in an unexpected manner, try refreshing the page.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium3

Low4

Versions scanned

Showing 2 of 9 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.54 Code review	4
1.52 Code review	7

Extension Version	Code Review Findings
1.54	4
1.52	7

Files with findings

3 distinct paths — top paths by unique finding count:

popup.js5
main.js4
popup.html2

S.No.	Category	Severity	File	Summary	Found in Version
1	Other	critical	main.js (line 250)	The extension extracts the CoWIN portal's SVG CAPTCHA image from a base64 data URI, parses it into an SVG DOM, strips noise paths, and reconstructs the answer by looking each path's `d` attribute up in the decoded obf…	1.52
2	Obfuscation	high	main.js (line 9)	A massive base64-encoded blob is hardcoded in the script and decoded at runtime via `atob()` then parsed as JSON. This is a classic obfuscation technique: the blob is actually a lookup table mapping SVG path `d`-attri…	1.52
3	Other	high	main.js (line 283)	This code reconstructs the CAPTCHA answer from SVG path data and then auto-types the solved value into the page before submitting the form. Combined with the large embedded `parsed_model` lookup table earlier in the f…	1.52
4	Tracking	high	popup.js (line 197)	Every time the bot successfully books a vaccination appointment, it silently fires a POST request to a developer-controlled AWS API Gateway endpoint with a hardcoded API key. Although the `data` payload is empty in th…	1.52
5	Code Injection	medium	popup.js (line 67)	The extension programmatically injects both `jquery.js` and `main.js` into the active tab's page context using `chrome.scripting.executeScript`. `main.js` contains the obfuscated CAPTCHA-solving model and DOM automati…	1.52
6	Tracking	medium	popup.js (line 196)	Extension silently POSTs to an AWS API Gateway endpoint with a hardcoded x-api-key whenever a user books a vaccine appointment, effectively reporting successful bookings to the developer without disclosure. Although t…	1.54
7	Tracking	medium	popup.js (line 190)	When an appointment is booked, the extension silently sends a POST request to an external AWS API using a hard-coded API key. The payload is empty here, but this is still undisclosed outbound telemetry tied to user ac…	1.52
8	Code Injection	low	popup.js (line 67)	Extension programmatically injects jquery.js and main.js into whatever tab is currently active when the user clicks Submit, using the scripting + activeTab permissions. Because no host restriction limits where the scr…	1.54
9	Other	low	main.js (line 8)	The core bot function has been intentionally short-circuited with `if (true) { return 1; }` — the actual automation logic that would have run in the user's tab has been stripped out, leaving the injection scaffolding …	1.54
10	Remote Code Loading	low	popup.html (line 7)	Popup loads a stylesheet from a third-party CDN (unpkg.com) at runtime. While an SRI hash is declared, loading remote resources from an extension popup expands the attack surface to a CDN the developer does not contro…	1.54
11	Remote Code Loading	low	popup.html (line 7)	The popup loads a CSS stylesheet from an external CDN (unpkg.com) at runtime. While a subresource integrity (SRI) hash is present and mitigates tampering of this specific version, loading any external resource from a …	1.52

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


unpkg.com	/[email protected]/dist/css/bootstrap-material-design.min.css	https://unpkg.com/[email protected]/dist/css/bootstrap-material-design.min.css
wjz4v0d5v2.execute-api.eu-west-1.amazonaws.com	/prod/cowinbot	https://wjz4v0d5v2.execute-api.eu-west-1.amazonaws.com/prod/cowinbot
cowin-bot.s3-eu-west-1.amazonaws.com	/tnc.html	https://cowin-bot.s3-eu-west-1.amazonaws.com/tnc.html
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
http:	-	http://www.imagemagick.org܆�tEXtThumb::Document::Pages1��/tEXtThumb::Image::height192r�tEXtThumb::Image::Width192Ӭ!tEXtThumb::Mimetypeimage/png?�VNtEXtThumb::MTime1620931662$��{tEXtThumb::Size0BB��

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Dear Developer,from date 17/06/2021, it is not working, please check & resolve it.

amit kuamr Singh·17 Jun 2021

Stopped working !!!!

Suhas Jadhav·17 Jun 2021

It worked in the past. Even after updating chrome and extension today, it gets stuck in the first attempt. Any tips and tricks to make it work ?

Sagar Ayare·16 Jun 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

CoWIN Bot

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 9 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews