Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Custom Cursors

CRITICAL RISKRemoved from Chrome Web Store

Custom Cursors

ID: emahfldafokoaffoemepdleijghheglo

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.2

Size

5.81 MB

Rating

2.9/5

Reviews

Users

4,841

Type

Extension

Updated

Jun 19, 2021

Publisher Contextual Analysis

Author: annaalekseeva162View Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

4,841

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Replace old boring cursor with new ones or upload your own.

If you are tired of a lackluster browser, then this extension is for you. The brightest cursors in this extension. You can use a large collection of colorful cursors or upload your own. It is possible to create your own cursors from any images. If you need, then you can use any cursor by default. Customize your browser however you want with our free extension. Custom Cursors lightweight and easy to use.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High2

Medium5

Low3

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	10

Extension Version	Code Review Findings
1.0	10

Files with findings

4 distinct paths — top paths by unique finding count:

scripts/content/initial_content.js4
scripts/pages/common_across.js3
scripts/pages/options_content.js2
scripts/background/bg_index.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	scripts/content/initial_content.js (line 225)	User-controlled data retrieved from localStorage ('CUTE_POINTERS_TOKEN' and 'CUTE_POINTERS_ERROR') is injected directly into a style element's innerHTML without sanitization. If an attacker or a malicious page can wri…	1.0
2	Privilege Escalation	high	scripts/background/bg_index.js (line 88)	On installation, the background script queries all open tabs and programmatically injects content scripts into every HTTP/HTTPS page using chrome.tabs.executeScript. This broad injection grants the extension code exec…	1.0
3	Code Injection	medium	scripts/pages/common_across.js (line 42)	User-controlled data from chrome.storage.local (specifically lopko.name, a cursor pack name) is interpolated directly into a jQuery HTML constructor string without sanitization. jQuery's $() with an HTML string parses…	1.0
4	Code Injection	medium	scripts/pages/common_across.js (line 51)	Multiple fields from storage-backed cursor objects (libdeer.name, data_2.name, libdeer.image, libdeer.cursor.path, libdeer.pointer.path) are interpolated unsanitized into an HTML string passed to jQuery's $() construc…	1.0
5	Obfuscation	medium	scripts/content/initial_content.js (line 25)	The codebase makes extensive use of meaningless obfuscated variable names (volatant, colpes, gogoliho, isterfag, entopar_argi, colpator, frostrator, toppera, kikol, offgerat, montikot) and obscures simple logic with t…	1.0
6	Unauthorized Data Collection	medium	scripts/content/initial_content.js (line 113)	A mousemove listener is attached to every page via document.onmousemove, capturing the DOM element under the cursor on every movement. The captured element's className is extracted and persisted to localStorage under …	1.0
7	Unauthorized Data Collection	medium	scripts/content/initial_content.js (line 47)	CSS class names of hovered elements are accumulated into an array stored in localStorage under 'CUTE_POINTERS_TOKEN'. This persists data that can describe the structure of third-party pages the user visits, including …	1.0
8	Code Injection	low	scripts/pages/options_content.js (line 65)	Data from chrome.storage.local (data[sitko].pointer.path and data[sitko].cursor.path) is interpolated directly into CSS background-image: url(...) values without sanitization. A maliciously crafted path value containi…	1.0
9	Unauthorized Data Collection	low	scripts/pages/common_across.js (line 88)	The extension queries all open browser tabs (chrome.tabs.query({})) and broadcasts a message to every tab's content script without any domain restriction. This pattern enumerates the user's full browsing session tab l…	1.0
10	Unauthorized Data Collection	low	scripts/pages/options_content.js (line 8)	User-uploaded image files are read via FileReader.readAsDataURL and their full base64-encoded content, dimensions, size, and filename are stored persistently in chrome.storage.local under verstak_store. The filename (…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

dont use these custom cursors there really bad and it even makes it harder to work 'for me' and to take it off go to the custom cursors and press undo

AHMED EL SAKKA·10 May 2021

So i see that everyone has this problem where they are unable to remove it either when trying to change it or when removing the extension. I've also had this problem and just found a very easy solution to it. All you need to do is close out of chrome and open it back up again. I don't know if this works with changing your cursor but it does work with getting rid of it after removing the extension.

Oreo Exe·24 Apr 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Custom Cursors

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews