Security Alert: Confirmed Malware
Eclipse dark theme
ID: ekkbggemkbjkphmeegnkfcjfihdknfdd
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Kathi WrightView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Eclipse is a neat dark theme for websites
Eclipse is a dark theme extension that works on many popular sites. If you turn on OS and browser dark mode, try it out to complete your experience. ❇️ Curated dark styles for popular websites ❇️ Blacklist website if it’s broken ❇️ Yellow tint enabled at night (You can disable it)
This injected stylesheet forces the browser to fetch an image from an unrelated third-party domain over plain HTTP whenever the Twitch theme is applied. That creates an unnecessary external beacon tied to page visits, and because it is unencrypted it also allows in-transit tampering of the fetched asset.
#left_col.warp,#large_nav.content,.social - column { background: #212121 url(http://file1.npage.de/010270/19/bilder/commentsback1.jpg) !important; border-right: 1px solid # 111 !important; box - shadow: none !important;}.theme--dark.sc - search { background: #212121 url(http://file1.npage.de/010270/19/bilder/commentsback1.jpg) !important; border: none !important; box-shadow: none !important;}The extension's injected WhatsApp stylesheet references an external image hosted on `raw.githubusercontent.com` instead of packaging the asset locally. Every affected page load can therefore generate a third-party request that exposes extension usage and browsing activity outside Chrome's extension package.
: root: not(#z),.dark: not(#z) { --version: 'Dark-WhatsApp USo-Lite 2.16.0 — June 25th, 2020'; --message: 'Towards v3 of DWA! Updating to `2.2027.9` of WhatsApp Web; check the changelog to see what is new!'; --changes: '\A\A https://github.com/vednoc/dark-whatsapp'; --ui - font: 'font_name', Segoe UI, Helvetica Neue, Helvetica, Lucida Grande, Arial, Ubuntu, Cantarell, Fira Sans, sans - serif !important; --r - menus: 4 px; --r - inputs: 24 px; --r - avatars: 50 %; --c - m - hover: 0.6 s; --c - m - delay: 1.2 s; --app - width: 1396 px; --emoji - o: 0.8; --bg - image: url("https://raw.githubusercontent.com/vednoc/dark-whatsapp/master/images/bg-blur-high.jpg"); --bg - opacity: 0.4; --bg - blur: 0 px; --bg - blur - s: calc(var (--bg - blur) * (-2)); --bg - hue: 320 deg; --bg - invert: 0;This stylesheet pulls a cursor image from `i.imgur.com` for an injected Google page theme. Using third-party hosted assets inside content-injected CSS is a suspicious pattern because it creates off-platform requests that can be used for passive tracking and are unnecessary for a local theme extension.
}canvas.ita-hwt-canvas { cursor: url('https://i.imgur.com/sjZV2eI.png') 0 10, auto !important;}# gt - pb - tb { border - color:By severity
Versions scanned
Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.4.2 | 3 |
| 0.4.1 | 3 |
Files with findings
5 distinct paths — top paths by unique finding count:
- inject.js2
- css/google.css1
- css/twitch.css1
- css/whatsapp.css1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.