Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Dark Theme

CRITICAL RISKRemoved from Chrome Web Store

Dark Theme

ID: oahgmfhelekagbjnhifehmoaiolilckg

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.0

Size

0.42 MB

Rating

4.5/5

Reviews

Users

153,858

Type

Extension

Updated

Oct 25, 2020

Publisher Contextual Analysis

Author: koorniliiilukinskiiView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

153,858

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Apply dark theme to all sites you use.

Bring something special to your everyday browsing and improve your Chrome with this simple but really cool extension. Dark theme for Chrome browser it`s not only cool but also useful extension that will protect your eyes at night time. Switch on \ off the Dark mode just in one click. This extension is really easy to work with and it doesn`t weigh a lot. Simple click on a button will turn on dark mode for all webpages. This Dark Mode app has awesome classic design and changes background color of every website to black. Install and don`t forget to leave your comment or request.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High3

Medium3

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	9

Extension Version	Code Review Findings
1.0	9

Files with findings

5 distinct paths — top paths by unique finding count:

assets/js/first-js.js4
assets/js/second-js.js2
assets/styles_for_websites/verga.css1
assets/styles_for_websites/vertu.css1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	manifest.json (line 11)	The extension injects moment.js (a 4,800-line date/time library) as a content script at document_start across all URLs, yet no extension code references or calls any moment.js API — the dark theme uses new Date() dire…	1.0
2	Unauthorized Data Collection	critical	assets/js/second-js.js (line 36)	Immediately upon installation, the background script queries ALL open browser tabs with no filter and programmatically injects first-js.js into every one of them. This grants the extension instant content-script acces…	1.0
3	Obfuscation	high	assets/js/first-js.js (line 1)	Every function, class, variable, and object key throughout all extension scripts uses meaningless numbered or nonsensical names (firstFunction, secondFunction, twelveFunction, thirtyFunction, fourtyFunction, twentySec…	1.0
4	Tracking	high	assets/js/first-js.js (line 30)	The extension enumerates 38 high-value domains including Gmail, Google Drive, Yahoo Mail, Amazon, eBay, WhatsApp, Instagram, Twitter, Messenger, and Dropbox. The content script runs at document_start with match_about_…	1.0
5	Unauthorized Data Collection	high	assets/js/first-js.js (line 201)	Facebook is hardcoded as a special-case target with its own CSS class injection (__fb-dark-mode), handled separately from the generic site-mapping object, yet no facebook.css file exists in web_accessible_resources. T…	1.0
6	Obfuscation	medium	assets/js/second-js.js (line 40)	The loop condition is some_index < love_data.length - 1 (strictly less than length minus one), meaning the last open tab is always skipped. This off-by-one is subtle and non-obvious — it could be an intentional evasio…	1.0
7	Tracking	medium	assets/styles_for_websites/verga.css (line 1)	This injected stylesheet causes WhatsApp Web visits to fetch a background image from `raw.githubusercontent.com`, an external third-party domain unrelated to the extension package. That is not needed for basic local t…	1.0
8	Tracking	medium	assets/styles_for_websites/vertu.css (line 1700)	This Gmail-specific stylesheet replaces an image with content loaded from `dark-by-dm9.webnode.it`, another third-party host. Loading remote assets into pages handling email is a suspicious design choice because it le…	1.0
9	Other	low	assets/js/first-js.js (line 1)	This content script runs at `document_start` on `<all_urls>` and all frames, then injects CSS into every matching page before the page finishes loading. That behavior is consistent with theming, but it materially expa…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

139

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


jquery.com	-	https://jquery.com/
sizzlejs.com	-	https://sizzlejs.com/
jquery.org	/license	https://jquery.org/license
github.com	/whatwg/html/issues/2369	https://github.com/whatwg/html/issues/2369
html.spec.whatwg.org	-	https://html.spec.whatwg.org/#nonce-attributes
js.foundation	-	https://js.foundation/
jsperf.com	/thor-indexof-vs-for/5	https://jsperf.com/thor-indexof-vs-for/5
www.w3.org	/TR/css3-selectors/	http://www.w3.org/TR/css3-selectors/#whitespace
www.w3.org	/TR/CSS21/syndata.html	http://www.w3.org/TR/CSS21/syndata.html#value-def-identifier
www.w3.org	/TR/selectors/	http://www.w3.org/TR/selectors/#attribute-selectors

Showing 1 to 10 of 140 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-
4.4.3.2	IPv4	-

4.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

i had a facebook one that worked on youtube also, cant remember what its called had to reinstall chrome but it was better on youtube , it showed the thumbs up and down on comments as blue if liked which this and no other does.

White _African_·19 Dec 2020

exactly what i was looking for

Jose Maita·16 Dec 2020

Does not work.

Dan Mikael Ydestrand·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Dark Theme

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews