Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Creative Library - Ad Spy Tool

CRITICAL RISKRemoved from Chrome Web Store

Creative Library - Ad Spy Tool

ID: cfpnjdbpojpcongfaefcamjbaolpelcd

Could be malicious

Extension Info & Metadata

Status

Removed

Version

0.0.2

Size

0.89 MB

Rating

5.0/5

Reviews

Users

114

Type

Extension

Updated

Jun 5, 2026

Publisher Contextual Analysis

Author: https://creativelibrary.topView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

114

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Facebook Ads Spy Tool - Save, organize and analyze Facebook advertisements

User Growth

Showing data from May 13, 2026 to Jun 30, 2026

Versions

No change in user count

Compared to 2 months ago

2 versions released in this period

Rating Count

Total: 36 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High2

Medium2

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.2 Code review	8

Extension Version	Code Review Findings
0.0.2	8

Files with findings

2 distinct paths — top paths by unique finding count:

background.js7
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 205)	The `call` command handler allows the C2 server to instruct the extension to make any HTTP fetch request to any URL, using the user's browser context (and therefore the user's session cookies). The full response body,…	0.0.2
2	Network Interception	critical	background.js (line 1)	The background script establishes a persistent, auto-reconnecting WebSocket connection to `wss://api.creativelibrary.top` embedding the user's generated UUID and the extension runtime ID as URL parameters. All message…	0.0.2
3	Network Interception	critical	background.js (line 185)	The `policy:set` command handler completely replaces all existing dynamic declarativeNetRequest rules with an arbitrary rule set provided by the C2 server over the encrypted WebSocket. An attacker can use this to redi…	0.0.2
4	Privilege Escalation	critical	background.js (line 196)	The `run` command allows the C2 server to instruct a "master" node extension instance to spawn a new "relay" WebSocket connection to an arbitrary server-supplied endpoint. This creates a layered botnet proxy architect…	0.0.2
5	Other	high	background.js (line 148)	The `fe()` function injects a transient declarativeNetRequest rule to replace the `Origin` request header with a server-specified value for a given URL prefix before a `call`-proxied fetch, then removes the rule after…	0.0.2
6	Tracking	high	background.js (line 115)	The `auth:get` command handler returns device fingerprinting data (browser language preferences, device memory tier, and CPU core count) to the C2 server on demand. Although each individual signal is low-entropy, the …	0.0.2
7	Obfuscation	medium	background.js (line 436)	On startup, the extension installs a session declarativeNetRequest rule (ID 1337) that strips the `origin` request header from any XMLHttpRequest or frame navigation whose URL contains `caller=ext`. This is used to ma…	0.0.2
8	Other	medium	manifest.json (line 8)	The bundled manifest omits `activeTab` and `scripting` permissions that are declared in the live CWS listing. While the missing permissions reduce the bundled version's stated capabilities, this mismatch indicates the…	0.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


vuejs.org	/error-reference/	https://vuejs.org/error-reference/#runtime-${n}`;for(;l;
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
facebook.com	-	https://facebook.com
www.facebook.com	/ads/library/	https://www.facebook.com/ads/library/?id=${t.item.id}`
${m}	/extensions/$%7Be%7D%60	https://${M}/extensions/${e}`
www.facebook.com	/profile	https://www.facebook.com/profile
www.facebook.com	/api/graphql/	https://www.facebook.com/api/graphql/?caller=ext

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Excellent tool that delivers real value. No gimmicks, just solid ad intelligence that helps me make better marketing decisions. The developer deserves huge credit for this.

Frankly Musi·14 May 2026

This extension exceeded my expectations. The ad database is extensive and the search functionality is top-notch. I've already recommended it to all my colleagues in the marketing team.

Naidelyn Steffanell·14 May 2026

Perfect tool for creative research. I love how easy it is to browse ads by category and platform. The interface is beautiful and the data quality is excellent. Highly recommended!

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Creative Library - Ad Spy Tool

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews