Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Fonts Determiner

CRITICAL RISKRemoved from Chrome Web Store

Fonts Determiner

ID: befajfpdjfcmdkhljkhlhpiehgonjbde

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.5.8

Size

0.09 MB

Rating

4.0/5

Reviews

Users

8,000

Type

Extension

Updated

Dec 13, 2023

Publisher Contextual Analysis

Trusted

Author: Stephen SotomayorView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

45,127

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No guessing what's the font on a website, know it for sure.

So many brilliant fonts are used at a numerous websites. It's an easiest way to find out which exactly font is on the page - use the extension What Font. Install the extension, click on it's logo and you'll get a name of the font you're interested in. Try it and don't forget to share your feedback with us. The extension needs an access to all websites to analyze fonts on every page you visit. We do not collect any sensitive data.

User Growth

Showing data from Aug 03, 2023 to Aug 01, 2024

Versions

-11.11%(-1,000 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 4 ratings

Average Rating

Current: 4.00 / 5.0+4.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High2

Medium1

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.5.7 Code review	8

Extension Version	Code Review Findings
1.5.7	8

Files with findings

2 distinct paths — top paths by unique finding count:

js/bg.js5
js/content.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	js/bg.js (line 141)	getCfg constructs RegExp objects from server-supplied rAllow/rDeny strings and tests them against the active page URL, then forwards the full state object (including server-controlled 'hash') to the content script. Th…	1.5.7
2	Obfuscation	critical	js/content.js (line 563)	Content script asks the background for server config and decodes a 'hash' string from the C2 into a window method name via split/reverse/join, then invokes window[i](handler). This is dynamic, server-controlled invoca…	1.5.7
3	Remote Code Loading	critical	js/bg.js (line 19)	Background service worker contacts the hard-coded C2 endpoint fontdeterminerpro.com on lifecycle events and opens whatever URL the server returns in a new tab via chrome.tabs.create. This is a server-controlled tab/re…	1.5.7
4	Remote Code Loading	critical	js/bg.js (line 115)	A periodic /ping/ to fontdeterminerpro.com pulls back arbitrary JSON which is merged directly into the extension's persisted state with Object.assign. Subsequent calls (getCfg, content.js) treat fields like rAllow/rDe…	1.5.7
5	Unauthorized Data Collection	critical	js/content.js (line 569)	When the server-controlled hash dispatch fires, this handler exfiltrates a detailed browser/device fingerprint (platform, userAgent platform/brands, network downlink/effective-type/RTT, hardware concurrency, frame sta…	1.5.7
6	Network Interception	high	js/content.js (line 584)	Top-frame content scripts setInterval-poll the background every 15 minutes (or whatever t.to the server returned) to refetch the config. Combined with the hash-driven dynamic dispatch above, this keeps the C2 channel …	1.5.7
7	Tracking	high	js/bg.js (line 45)	On install, the extension calls fontdeterminerpro.com/trck/install.php with credentials:'include' (sending cookies for that domain) and again opens a server-supplied URL in a tab. This combines install tracking with a…	1.5.7
8	Obfuscation	medium	js/bg.js (line 72)	The persistent UID and extension metadata are base64-JSON encoded and attached as a 'p=' parameter; the same opaque payload format is used for install, action, ping, and uninstall reporting. The base64+JSON wrapping s…	1.5.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
www.google.com	/webfonts/family	http://www.google.com/webfonts/family?family=

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.3 out of 5 · 6 most recent reviews

Text reviews

Positive

Negative

works nice

Patsy O'Hara·9 Oct 2023

Very Very Helpful for Frontend-Development!

Kostyantyn Do·9 Oct 2023

works nice

ดป

ดวงกมล ประดากรณ?·9 Oct 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Fonts Determiner

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating