Chrome Web StoreNo malware found
In code review (v0.1.2)
Our reviewer read version 0.1.2 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.
13 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Download by Internet Download Manager, used by 60,668 people, showed no malicious code in Extension Auditor's review. Our code review reported 2 findings (1 medium, 1 low), led by privilege escalation. Its permissions mean it can observe network requests.
Key findings
- Medium
Privilege Escalation
The extension sends a JavaScript script string to the native messaging host (emano.waldeck) that uses child_process.spawn to execute an arbitrary binary path taken from user-configurable storage (prefs.executable). If the native messaging host evaluates this script with full privileges, a malicious actor who controls the prefs.executable storage value could escalate to arbitrary code execution on the host. The script is hardcoded in this version, not fetched remotely, which limits actual exploitability in this release.
- Low
Remote Code Loading
The guide page fetches the latest release metadata from GitHub and downloads a zip file containing the native messaging host binary. While GitHub is a reputable host, this is a supply-chain trust point: if the Emano-Waldeck GitHub account is compromised, users who click 'download native client' would silently receive a trojanized binary. This is an accepted trade-off in the native-messaging extension ecosystem but represents a real risk surface.
Analyst notes
The extension's source code is transparent and coherently implements its stated purpose — intercepting browser downloads and routing them through Internet Download Manager via native messaging. The webRequest blocking listener (:83-86) only activates on requests and checks Content-Type to redirect qualifying file downloads; it collects no user data. The most powerful primitive,:45-64, sends a hardcoded child_process.spawn script via native messaging to launch the IDM executable with the download URL — this is the standard pattern for IDM browser integrations and is not dynamically generated from a remote source. The publisher's 38% malicious-extension rate and the chrome-stats 'policy_violation' removal are concerning corroborating signals, but the code itself shows no exfiltration, obfuscation, or C2 communication; the ML model likely over-fit on the dangerous permission combination ( *://*/*) rather than detecting actual malicious behavior.
Download by Internet Download Manager Chrome extension security report
ID: lgbipmmmnjifkiiikaffhceflifbmhib
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- emano.waldeck
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
13 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Use Internet Download Manager or another external download manager to get large files with pause, resume, and schedule support
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
13 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.