Chrome Web StoreDo not install
Code review: critical (v1.0.7)
Our reviewer read version 1.0.7 of this extension and confirmed malicious behaviour. 4 security findings documented below. Do not install it. Remove it if you already have it.
3 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Dark Reader for Chrome, used by 7,000 people, is rated malicious by Extension Auditor. Our code review reported 4 findings (2 critical, 2 high), led by remote code loading. Its permissions mean it can read and change data on all websites and can inject scripts into pages.
Key findings
- Critical
Remote Code Loading
The content script (declared for *://*/* in all frames) asks the service worker for a server-fetched config, then reconstructs the name of a global function at runtime from the server-supplied `hash` field by stripping non-letters, splitting on a server-chosen delimiter, reversing and rejoining, and finally calls `window[decodedName](o.qaRoutine)` where `e` is `window`. Hiding the invoked API behind a server-controlled string transform is deliberate anti-analysis: the call target cannot be determined from the shipped code and can be changed remotely after store review. Because `Object.assign(o, t)` at line 42 lets the server also overwrite `o.qaRoutine` with a string, decoding to a string-eval sink such as turns this into a remote script-execution primitive on every page the user visits.
- Critical
Other
The worker only releases the server-controlled config to a content script when the remote `extStat` flag is set and the requesting frame's URL matches a server-supplied regex, so the hidden behaviour is dormant by default and can be switched on remotely for an arbitrary, operator-chosen subset of sites after store review. That is a classic delayed-activation / selective-targeting kill switch rather than a feature flag, and the ` ` short-circuit plus the latent `optout` state show the config surface anticipates behaviour well beyond theme switching. Combined with the runtime-decoded dispatch in, the operator retains post-publication control over what code runs in every page the user loads.
- High
Unauthorized Data Collection
The payload handed to the remotely-decoded dispatcher assembles a device fingerprint (appVersion, network, platform, userAgentData brands, CPU core count, frame position) and ships it to [domain withheld]. The CWS listing declares no data collection at all, so this undisclosed fingerprint collection fails the disclosure cross-check even though the destination is the publisher's own domain, and none of these values are needed to apply a CSS invert filter. The misleading `qa_metric`/`qaRoutine` naming and the fact that it only fires when the server flips `extStat` mark it as covert rather than ordinary diagnostics.
- High
Tracking
Every 15 minutes (driven by the _drAlarm alarm) the worker beacons a base64-wrapped blob containing a locally generated persistent UUID (lines 53-57) plus cumulative active-use timing to [domain withheld], then merges the JSON reply into the state object it later serves to content scripts. Base64-encoding a querystring payload serves no transport purpose and keeps the exfiltrated fields out of plain-text inspection; the persistent UUID plus usage timers constitute undisclosed cross-session user tracking against a CWS listing that declares no data collection. The response-merge makes this the inbound half of the C2 loop rather than a genuine update check, since nothing in the reply is used for updating.
Analyst notes
Behind a working ~130-line feature, the extension ships a remote command-and-control channel::30-44 beats a base64-wrapped payload (persistent UUID, per-extension usage timing) to [domain withheld] and Object.assign's the JSON response straight into its runtime config, which:66-75 then hands to the all-URLs content script;:39-59 gates on a server-supplied `extStat` kill switch plus server-supplied `rAllow`/`rDeny` regexes matched against location.href, reconstructs a window method name at runtime from a `hash` string the server controls (), and invokes `window[decodedName](o.qaRoutine)`. That runtime-decoded dispatch target, per-site remote targeting, and the dormant navigator-fingerprint beacon to / (CWS data collection is 'none declared') have no relationship to inverting page colors; the permhash cluster at 56% flagged-malicious, the publisher-malicious flag and the store removal only corroborate a conclusion the code already establishes on its own.
Dark Reader for Chrome Chrome extension security report
ID: omfeeokgnjnjcgdbppmnijlmdnpafmmp
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Dark dev.
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
3 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
A classic Dark theme for every website. Switch any web pages to dark mode or night shift mode in one click.
Read the publisher’s full description
Dark Reader - Dark Mode and Night Shift is a fast, lite and simple extension that automatically turns the colors of your browser content to warmer or darker. This eye-care extension enables night mode by creating dark themes for websites on the fly. Dark Reader inverts bright colors, making them high contrast and easy to read at night. What will you get from Dark Mode extension: 1) An easy way to create dark mode on every website. In addition, you can customize your dark theme visual from Brightness, Contrast, to Saturation. 2) A night shift mode which changes the website's color to warmer, making it much more pleasing to watch. You can choose to use either dark theme or night shift mode, or both. Turning on reading mode protect your eyes from reading for hours. You can manually choose the shift from color presets, to pick up the most comfortable and calm atmosphere for your eyes during the night sessions or thru the all day long. Social networks, mainstream sites, and all other new tabs will be in dark mode with Dark Theme extension. No needs to open every website settings one by one - just one add-on makes every website in dark mode. Note: Remember to disable any similar dark theme or night shift mode extension to prevent compatibility issues. We really hope that our Dark Reader will be useful to you! We look forward to your feedback and ratings! Also write your suggestions for improving the functionality.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
3 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
Popular in Workflow & Planning
- Adobe Acrobat: PDF edit, convert, sign tools347,000,000 users
- Application Launcher For Drive (by Google)101,000,000 users
- Chrome Remote Desktop41,000,000 users
- Microsoft Single Sign On36,000,000 users
- Free VPN for Chrome - VPN Proxy VeePN15,000,000 users