Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Extension Manager

CRITICAL RISKRemoved from Chrome Web Store

Extension Manager

ID: aikoefhdlgldhhnmojgbdcnoaangneaj

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.0.7

Size

0.05 MB

Rating

3.7/5

Reviews

Users

10,101

Type

Extension

Updated

Dec 2, 2022

Publisher Contextual Analysis

Trusted

Author: amymurphey97View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,101

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Extension Organizer is created disable all extensions by default, enable all extensions on all sites, or enable them on some sites.

Ext Organizer is a one-of-a-kind tool designed to help users manage active extensions. Ext Organizer allows for the specification of certain extensions to be used on specific web pages and allows users to turn off or on all extensions for all pages. Ext Organizer makes it easier for working professionals and students to manage extension use.

User Growth

Showing data from Dec 03, 2022 to Mar 07, 2023

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 3 ratings

Average Rating

Current: 3.67 / 5.0+3.67

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High2

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.7 Code review	6

Extension Version	Code Review Findings
1.0.7	6

Files with findings

1 distinct path — top paths by unique finding count:

js/background.js6

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.js (line 123)	On every http/https navigation, the extension uses an obfuscated regex to detect search engine query URLs (matches Google/Bing/Yahoo-style /search?q= patterns). When a search is detected, it hijacks the navigation by …	1.0.7
2	Data Exfiltration	critical	js/background.js (line 143)	Every URL the user navigates to (including subframes) is exfiltrated to https://extorganizer.com/u/?checksafe=<full_url> along with the per-install tracking token in the 'ur_safe' header. This constitutes wholesale br…	1.0.7
3	Unauthorized Data Collection	critical	js/background.js (line 208)	The checkSafe handler is wired to chrome.webNavigation.onBeforeNavigate for every http/https URL with no host filter, ensuring the data-exfiltration and search-hijack logic above runs on 100% of the user's web navigat…	1.0.7
4	Network Interception	high	js/background.js (line 195)	Whenever DNS resolution fails for any site the user visits, the extension redirects the tab to https://extorganizer.com/i/?nx=<failed_hostname>. This is classic NXDOMAIN/typosquatting monetization: the attacker-contro…	1.0.7
5	Tracking	high	js/background.js (line 112)	On install, the extension generates a 32-byte cryptographically random token and stores it in chrome.storage.sync as a stable user identifier ('c'), which is then attached to every search-hijack redirect and URL exfil…	1.0.7
6	Obfuscation	medium	js/background.js (line 128)	The search-hijack detection uses an intentionally obfuscated character-class regex to match common search engines (google/bing/yahoo) without spelling the brand names in plaintext. Obfuscating the targeted domains is …	1.0.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


extorganizer.com	-	https://extorganizer.com/
*	/*	http:///
*	/*	https:///
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
dev.to	-	https://dev.to
extorganizer.com	-	https://extorganizer.com
extorganizer.com	/s/	https://extorganizer.com/s/?c=
extorganizer.com	/u/	https://extorganizer.com/u/?checksafe=
extorganizer.com	/thankyou/	https://extorganizer.com/thankyou/
extorganizer.com	/uninstalled/	https://extorganizer.com/uninstalled/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.0 out of 5 · 2 most recent reviews

Text reviews

Positive

Negative

it forces default to yahoo and isn't even that useful. plus you have to install it to enter websites that have it as a sponsor.

Carson Froelich·6 Mar 2023

this f**ing app changes default search to Yahoo even if i remove this from search engines. It is virus!

Michael Semirunniy·15 Feb 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Extension Manager

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews