Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Easy Page Save

CRITICAL RISKRemoved from Chrome Web Store

Easy Page Save

ID: fdcgafeollfblpppklndmihjkjohjhbg

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

0.0.5

Size

0.06 MB

Rating

4.3/5

Reviews

Users

15,104

Type

Extension

Updated

Dec 3, 2022

Publisher Contextual Analysis

Trusted

Author: streeter.bob1995View Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

15,104

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Take a screenshot and save anywebpage you're on using Keyboard Commnd: Alt+P.

Easily and securely take a screenshot of any webpage you visit! Easy Page save goal is to make it easy and safe for anyone to save photos, text, Web pages, and emails in a quick and safe process. On any webpage, use Alt+p and take a screen shot that immediately downloads in chrome. Easy page save does not collect or save any personal information. Your security is our top concern.

User Growth

Showing data from Dec 05, 2022 to Feb 27, 2023

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 3 ratings

Average Rating

Current: 4.33 / 5.0+4.33

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.5 Code review	6

Extension Version	Code Review Findings
0.0.5	6

Files with findings

1 distinct path — top paths by unique finding count:

background.js6

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 100)	Every navigated URL (main frame and sub-frames) is sent to a remote endpoint at easypagesave.com, along with a persistent per-install tracking token (`ur_safe` containing a random `c` token and counter `n`). The serve…	0.0.5
2	Network Interception	critical	background.js (line 84)	This obfuscated regex (`[bgy]([ngioah]{3,4})(le)?\.([a-z\.]{2,6})...(\/s.{3})ch`) is crafted to match search-engine URLs (Google/Bing/Yahoo) without naming them in plaintext, then hijacks the user's tab to easypagesav…	0.0.5
3	Unauthorized Data Collection	critical	background.js (line 165)	The extension hooks every http/https navigation via webNavigation.onBeforeNavigate and routes URLs through checkSafe, which silently exfiltrates browsing activity to easypagesave.com. This is far outside the stated 's…	0.0.5
4	Network Interception	high	background.js (line 152)	On any DNS resolution failure (e.g. typos, expired domains, captive-portal scenarios) the extension hijacks the tab to easypagesave.com/i/?nx=<failed-hostname>. This intercepts and monetizes navigation errors, leaking…	0.0.5
5	Obfuscation	high	background.js (line 80)	The character-class obfuscation in the URL-matching regex (e.g. `[whcraes\.]`, `[bgy]`, `[ngioah]{3,4}`) is deliberately constructed to avoid mentioning target domains literally, defeating static review and string-bas…	0.0.5
6	Tracking	high	background.js (line 70)	On install the extension generates a 32-byte random per-user token (`c`) and a monotonically increasing counter (`n`) that is sent with every navigation report to easypagesave.com. This produces a stable cross-site fi…	0.0.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


easypagesave.com	-	https://easypagesave.com/
easypagesave.com	/s/	https://easypagesave.com/s/?c=
easypagesave.com	/u/	https://easypagesave.com/u/?checksafe=
easypagesave.com	/thankyou/	https://easypagesave.com/thankyou/
easypagesave.com	/uninstalled/	https://easypagesave.com/uninstalled/
easypagesave.com	/i/	https://easypagesave.com/i/?nx=
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
easypagesave.com	-	https://easypagesave.com
*	/*	http:///
*	/*	https:///

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

Nice. Super easy way to save pages to bookmarks.

Threex Domains·22 Jan 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Easy Page Save

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating