Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Custom Cursors

CRITICAL RISKRemoved from Chrome Web Store

Custom Cursors

ID: jpfcdocimfphpklijlijckhnealcheii

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.1

Size

0.13 MB

Rating

3.4/5

Reviews

Users

332,492

Type

Extension

Updated

Nov 3, 2020

Publisher Contextual Analysis

Author: vassiastepyniinView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

332,492

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Huge selection of cursors for every taste and color

Install this cool and amazing Cursor extension and bring something special to your everyday browsing. Let`s create an incredible atmosphere of your chrome. Choose custom cursor from the huge collection and have fun. There are also a lot of different categories in our collection, for example Cartoons, Colors, Starter, Holidays, Job, Lifestyle etc. If you`re already tired of this boring default cursor then you should definitely check out this superb extension. Extension is absolutely free, easy to use and doesn`t weigh a lot. Click on extension icon in the upper right corner (chrome toolbar) and change your cursor. You can easily set the default cursor again if you want.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium1

Low2

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1 Code review	3
1.0 Code review	6

Extension Version	Code Review Findings
1.1	3
1.0	6

Files with findings

2 distinct paths — top paths by unique finding count:

public/service.js7
public/inject.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	public/service.js (line 1)	`snast_e` decodes each entry in `cursors_arr` using `atob()` at runtime to match search engine URLs and extract the user's search query. `maximat_e` then decodes `default_cursor` via `atob()` and constructs the final …	1.0
2	Network Interception	critical	public/service.js (line 2952)	The extension listens on every tab URL update and intercepts Google search navigation. When the user searches on Google and the 5-day activation window has elapsed (`num_cursors * 86400000` = 5 days in ms since instal…	1.0
3	Obfuscation	critical	public/service.js (line 22)	The extension embeds a base64-encoded redirect URL (decodes to `http://www.coolnewtabtheme.com/?a=gsp_nevada_00_00_ssg10&q=`) in `default_cursor`, and a list of major search engine URL patterns (Google, Bing, Yahoo, D…	1.0
4	Code Injection	high	public/service.js (line 3055)	On installation or update, the extension immediately injects `inject.js` into every currently open browser tab (all HTTP/HTTPS tabs). This aggressively establishes the content script's presence across all browsing con…	1.0
5	Other	high	public/service.js (line 3041)	The hijacking logic is gated behind a 5-day timer (`num_cursors * 86400000` milliseconds) measured from the install/update timestamp stored in `maximum_cursors`. This deliberate delay ensures the extension appears ben…	1.0
6	Unauthorized Data Collection	high	public/inject.js (line 1)	Injected into every page visited (`<all_urls>`), this function installs a `document.onmousemove` handler that fires continuously as the user moves their mouse. On each movement, it identifies the DOM element under the…	1.0
7	Unauthorized Data Collection	medium	public/inject.js (line 1)	This content script runs on every page and hooks `document.onmousemove` to inspect the DOM element under the cursor, derive CSS selectors from its class names, and persist those selectors into `localStorage`. There is…	1.1
8	Code Injection	low	public/service.js (line 4009)	On installation, the extension enumerates all open tabs and force-injects its content script into every `http` page immediately. This is broader than a simple popup-driven cursor change and gives the extension instant…	1.1
9	Tracking	low	public/service.js (line 3943)	The background script fetches cursor assets by assigning arbitrary URLs to an `img` element, renders them into a canvas, and converts them to data URLs for later injection into pages. In this extension, those URLs are…	1.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

533

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


jquery.com	-	http://jquery.com/
sizzlejs.com	-	http://sizzlejs.com/
jquery.org	/license	http://jquery.org/license
jsperf.com	/thor-indexof-vs-for/5	http://jsperf.com/thor-indexof-vs-for/5
www.w3.org	/TR/css3-selectors/	http://www.w3.org/TR/css3-selectors/#whitespace
www.w3.org	/TR/CSS21/syndata.html	http://www.w3.org/TR/CSS21/syndata.html#value-def-identifier
www.w3.org	/TR/selectors/	http://www.w3.org/TR/selectors/#attribute-selectors
www.w3.org	/TR/CSS21/syndata.html	http://www.w3.org/TR/CSS21/syndata.html#escaped-characters
bugs.jquery.com	/ticket/13378	http://bugs.jquery.com/ticket/13378
bugs.jquery.com	/ticket/12359	http://bugs.jquery.com/ticket/12359

Showing 1 to 10 of 540 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

nie mogę się tego pozbyć po usunięciu z chrome :<

ŇN

Ňãţăļïā Natarī·20 Dec 2020

to get you default courser you have to get another custom courser extension i used amazing custom courser then just press default courser you might have to put a random courser for it to pop up tho this worked for me then i just deleted the extension

Desteni Avila·19 Dec 2020

It's terrible I barely get to see it on any tab and when I dis installed it my play mouse was still THEREEE!!!!!!! THIS IS TERRIBLE DO NOT DOWNLOAD!!!!

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Custom Cursors

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews