Security Alert: Confirmed Malware
eTab
ID: idnfpcpfaamcjidcakmafaffmepnkhle
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Locksley LtdView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Website
- Visit
An extension that will provide you with a motivating picture whenever you open a new tab in your browser.
Looking for a way to spruce up your browsing experience? Look no further than this fantastic extension! With just a quick installation, you can enjoy beautiful, high-quality images every time you open a new tab in your web browser. Whether you're searching for inspiration, taking a quick break from work, or simply looking to add some visual interest to your daily routine, this extension is the perfect way to enhance your browsing experience. So why wait? Install now and start enjoying stunning, eye-catching images every time you open a new tab! To change the background image click the Change Background Icon in the top right on new tab. Search results are provided by Microsoft Bing. Privacy Policy: https://etab-extension.com/privacy-policy Terms of Use: https://etab-extension.com/terms-and-conditions
Sensitive Domain Access
This extension has access to the following sensitive domains:
- https://api.bing.com/*
- https://api.bing.com/*
The extension polls https://etabextension.com/config every minute (via a chrome.alarm) and downloads a remote JSON manifest of images/videos/animations. Any entry flagged 'featured' by the remote server overrides the user's chosen wallpaper for a server-controlled duration ('featuredInterval'), giving the publisher a remote channel to push arbitrary visual content (including 'video' assets and overlay copy) onto the new-tab page after install, with no user opt-in.
async function l(e) { const t = await r.a.get(["currentImage", "imageData", "lastFeatured"]), a = await fetch(`${o.BASE_URL}config?t=${Date.now()}`), n = await a.json(); r.a.set({ config: n }); const l = []; n.animations.forEach(e => { l.push({ ...e, type: "animation" }) }), n.videos.forEach(e => { l.push({ ...e, type: "video" }) }), n.images.forEach(e => { l.push({ ...e, type: "image" }) }); const f = l.filter(e => e.featured), d = f.filter(e => -1 === t.lastFeatured.indexOf(e.id)), m = f.map(e => e.id); if (r.a.set({ lastFeatured: m }), t.currentImage && d[0] && !e) { const e = d[0]; Object(i.getFile)(e.id) .then(t => t || Object(i.saveFile)(e.id, e.full)) .then(a => { r.a.set({ revertFeatured: { id: t.currentImage, timestamp: Date.now() + 1e3 * e.featuredInterval } }), s(e.id) }) }The new-tab page contains a dedicated full-viewport <video id="ad-player"> element plus a hidden overlay with a headline and 'cta' (call-to-action) span. Combined with the remotely fetched config that supplies videos and 'featured' assets, this is undisclosed advertising/promotional injection — the store description says the extension only shows 'a motivating picture', not autoplay video ads with click-through CTAs sourced from a publisher-controlled server.
<div class="video-wrapper static"><video id="background" autoplay="autoplay" loop="loop"></video></div><div class="video-wrapper static"><video id="ad-player" autoplay="autoplay"></video></div><div id="overlay" style="display:none"> <div id="overlay-icon-container"> <img src="..."> </div> <div id="overlay-body"> <span id="overlay-headline"></span> <span id="cta"></span> </div></div>On extension install, the service worker silently calls https://etabextension.com/install.php with same-origin credentials. This is an undisclosed install-tracking beacon used to count/identify newly installed users without notice or consent, and the use of credentials means any cookie set by the publisher's domain (e.g. via the bundled new-tab page) is sent along, enabling cross-context user tracking.
chrome.runtime.onInstalled.addListener(({ reason: e}) => { "install" === e && fetch(r.BASE_URL + "install.php", { credentials: "same-origin" })})A persistent alarm re-pulls the remote etabextension.com config every minute for the lifetime of the install. This high-frequency callback to a publisher-controlled endpoint is consistent with a beacon/heartbeat that keeps the extension reachable for content swaps and is more aggressive than is needed for refreshing a 'motivating picture' new-tab background.
chrome.alarms.get("refresh-config", e => { e || chrome.alarms.create("refresh-config", { periodInMinutes: 1 })}), chrome.alarms.onAlarm.addListener(({ name: e}) => { "refresh-config" === e && l()})By severity
Versions scanned
Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.3 | 4 |
Files with findings
3 distinct paths — top paths by unique finding count:
- 1.bundle.js2
- background.bundle.js1
- newtab.html1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.