Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Dark forest

CRITICAL RISKRemoved from Chrome Web Store

Dark forest

ID: nbejglnjjfpmdfjomccggabecdiblibl

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.4.6

Size

0.46 MB

Rating

3.8/5

Reviews

Users

569,082

Type

Extension

Updated

Aug 12, 2021

Publisher Contextual Analysis

Author: Clara MenaView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

569,082

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Dark forest - tailored dark theme for most polular sites

Dark forest is a well-tuned dark theme bundle for popular websites. We track website changes and update themes regularly. Features: - Works on many sites - you don’t need to have a long list of extensions to do the thing - Blacklist - if you don’t like the theme or just want it bright - Night shift - enable yellow tint and help you eyes If some site is broken or you encountered some other issue: Send us a feedback with this form: <google forms url> Add the site to the blacklist Wait for an update

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High1

Medium2

Low4

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.4.6 Code review	4
1.4.5 Code review	5

Extension Version	Code Review Findings
1.4.6	4
1.4.5	5

Files with findings

6 distinct paths — top paths by unique finding count:

background.js2
manifest.json2
popup.html2
css/twitch.css1
css/vk.css1
css/whatsapp.css1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	background.js (line 1)	The code initializes a standard Google Tag Manager dataLayer object (f[0]['gtm.start'] = +new Date, f[0].event = 'gtm.js') and sets it as top.item, exactly matching the GTM initialization pattern. The use of 'top' (ra…	1.4.5
2	Tracking	critical	background.js (line 1)	Heavily obfuscated code secretly injects Google Tag Manager (container ID GTM-TDXTR6J) into the page. The string 'gtm' is built by reversing the array ['m','t','g'], '.js' by reversing ['s','j','.'], producing URL htt…	1.4.5
3	Tracking	high	manifest.json (line 1)	The manifest's Content Security Policy explicitly whitelists https://www.googletagmanager.com, which is the exact domain used by the obfuscated script injection in background.js. This CSP was deliberately crafted to p…	1.4.5
4	Tracking	medium	css/twitch.css (line 256)	Injected CSS for Twitch causes the browser to fetch a background image from an unrelated third-party host over plain HTTP. That creates unnecessary off-site requests whenever the style is applied, enabling passive tra…	1.4.6
5	Unauthorized Data Collection	medium	manifest.json (line 1)	moment.js (a date/time library with no UI functionality) is injected as a content script at document_start on every URL the user visits. A dark mode extension has no legitimate reason to inject moment.js into every pa…	1.4.5
6	Remote Code Loading	low	popup.html (line 1)	The extension popup pulls a stylesheet from a remote CDN at runtime instead of packaging all assets locally. While this is not executable JavaScript, it still creates an external network dependency for extension UI an…	1.4.6
7	Tracking	low	css/vk.css (line 746)	This style references image assets hosted on Imgur rather than bundling them inside the extension. Because the extension injects CSS into web pages, these remote image fetches can leak user browsing activity on matchi…	1.4.6
8	Tracking	low	css/whatsapp.css (line 6)	The WhatsApp theme fetches a background image from GitHub's raw content domain at runtime. This is not direct data exfiltration, but it does create an external beacon tied to page rendering and depends on remotely hos…	1.4.6
9	Unauthorized Data Collection	low	popup.html (line 5)	The popup loads Bootstrap CSS from an external CDN (stackpath.bootstrapcdn.com) rather than bundling it locally. While the SRI integrity hash is present, external resource loading from extension popups establishes a n…	1.4.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

140

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


chrome.google.com	-	https://chrome.google.com
github.com	/liorgrossman/darkness/tree/master/chrome-extension/themes	https://github.com/liorgrossman/darkness/tree/master/chrome-extension/themes
userstyles.org	/styles/126925/bing-dark	https://userstyles.org/styles/126925/bing-dark
colincon.ga	-	http://colincon.ga
userstyles.org	/styles/101431/new-duckduckgo-dark-theme	https://userstyles.org/styles/101431/new-duckduckgo-dark-theme
userstyles.org	/styles/120329/ebay-dark-black-midnight-smacked	https://userstyles.org/styles/120329/ebay-dark-black-midnight-smacked
userstyles.org	/styles/37035/github-dark	https://userstyles.org/styles/37035/github-dark
github.com	/DM164/Dark-by-DM	https://github.com/DM164/Dark-by-DM
dark-by-dm9.webnode.it	/_files/200000046-93235941c7/200/ImBob.png	https://dark-by-dm9.webnode.it/_files/200000046-93235941c7/200/ImBob.png
hangouts.google.com	-	https://hangouts.google.com/

Showing 1 to 10 of 140 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-
4.4.3.2	IPv4	-

3.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Doesn't even work

Cloud2K IT Solutions International·10 Aug 2021

justo lo que buscaba para usar ig recomendada

Gonzalo Castro·9 Aug 2021

It worked great with Google Drive and Google docs at first. Then it will begin to glitch in such a way that it will only half work and create a lot of issues. Part of the background will turn back to white, but the text will remain white. Uninstalling and reinstalling does not fix it

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Dark forest

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews