Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Get cookies.txt

CRITICAL RISKRemoved from Chrome Web Store

Get cookies.txt

ID: bgaddhkoddajcdgocldbbfleckgcbcid

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.9

Size

1.63 MB

Rating

3.3/5

Reviews

110

Users

159,481

Type

Extension

Updated

Feb 21, 2023

Publisher Contextual Analysis

Trusted

Author: getcookies.txtView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

159,481

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Exports your cookies to the Netscape cookie file format a.k.a. cookies.txt which is compatible with wget, curl, youtube-dl and more.

Exports your cookies to the Netscape cookie file format a.k.a. cookies.txt which is compatible with wget, curl, youtube-dl and more. The Netscape cookie file format stores one cookie per physical line in the file with a bunch of associated meta data, each field separated with TAB. That file is called the cookiejar in curl terminology. The cookie file format is text based and stores one cookie per line. Lines that start with # are treated as comments. This extension can be super useful in circumstances of using the authenticated cookies from your Chrome browsing session. The cookies can be exported by clicking on the 'blue' download button or by clicking on 'Get cookies.txt' in the Chrome context menu on any website.

User Growth

Showing data from Jan 01, 2022 to Jan 08, 2023

Versions

+9.43%(+13,739 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 60 ratings+2 (3%)

Average Rating

Current: 4.10 / 5.0+0.18

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High4

Medium2

Low0

Versions scanned

Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	8

Extension Version	Code Review Findings
1.0	8

Files with findings

3 distinct paths — top paths by unique finding count:

js/app.js4
js/contentScript.js2
manifest.json2

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/app.js (line 74)	This code serializes full cookie records, including names and raw values, into a plaintext Netscape cookie file and writes it to disk. Exporting live session cookies in reusable format is effectively a cookie theft ca…	1.0
2	Unauthorized Data Collection	critical	js/app.js (line 19)	The extension calls chrome.cookies.getAll({}) with an empty filter object, which retrieves the ENTIRE browser cookie store across all domains and all sessions before filtering client-side. This means the full set of a…	1.0
3	Code Injection	high	manifest.json (line 29)	The manifest explicitly relaxes the extension's Content Security Policy to allow unsafe-eval, which permits dynamic code execution via eval(), new Function(), and setTimeout(string). Chrome's extension platform disabl…	1.0
4	Code Injection	high	js/contentScript.js (line 27)	Cookie field values (domain, name, value, path) are interpolated directly into an HTML string and then inserted into the DOM via jQuery's .append(), with no HTML escaping or sanitization. An attacker who can set a coo…	1.0
5	Unauthorized Data Collection	high	js/app.js (line 49)	A webNavigation.onCompleted listener fires on every completed page load across all tabs, triggering a full chrome.cookies.getAll({}) call each time. Combined with the broad host permissions (http:/// and https:///…	1.0
6	Unauthorized Data Collection	high	js/app.js (line 19)	This helper reads the entire browser cookie jar with `chrome.cookies.getAll({})` and only filters results afterward in extension code. That gives the extension access to authentication and session cookies for any site…	1.0
7	Code Injection	medium	js/contentScript.js (line 16)	The popup renders full cookie values directly into the extension UI, exposing sensitive session material to anyone with local access to the browser. It also injects cookie fields into HTML with string concatenation an…	1.0
8	Privilege Escalation	medium	manifest.json (line 35)	The extension injects a content script into every HTTP and HTTPS page the user visits, granting it DOM access to all web content. While the injected contentScript.js does not appear to transmit data externally in this…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


icofont.com	-	https://icofont.com
icofont.com	/license/	https://icofont.com/license/
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
ck.getcookiestxt.com	/getcookie	https://ck.getcookiestxt.com/getcookie
curl.haxx.se	/rfc/cookie_spec.html/n	http://curl.haxx.se/rfc/cookie_spec.html\n#
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


7.9.2.1	IPv4	-
3.3.5.3	IPv4	-
1.1.3.5	IPv4	-
3.3.8.8	IPv4	-
1.1.3.3	IPv4	-
1.1.8.5	IPv4	-
1.4.3.5	IPv4	-
1.48.22.78	IPv4	-
42.82.11.84	IPv4	-
41.6.1.5	IPv4	-
73.3.3.3	IPv4	-
8.2.8.2	IPv4	-
3.1.5.1	IPv4	-
46.3.8.9	IPv4	-
8.7.9.3	IPv4	-
124.2.3.9	IPv4	-
2.6.3.5	IPv4	-
3.7.1.8	IPv4	-
3.6.1.8	IPv4	-
3.9.1.6	IPv4	-
3.2.2.9	IPv4	-
2.9.3.9	IPv4	-
2.7.2.9	IPv4	-
3.1.2.6	IPv4	-
3.3.1.2	IPv4	-
2.3.3.5	IPv4	-
12.2.2.4	IPv4	-
3.3.3.5	IPv4	-
3.2.3.5	IPv4	-
3.2.2.4	IPv4	-
3.3.2.2	IPv4	-
3.5.5.7	IPv4	-
99.4.9.1	IPv4	-
3.4.2.8	IPv4	-
3.9.1.7	IPv4	-
1.7.1.5	IPv4	-
58.37.91.55	IPv4	-
2.9.2.1	IPv4	-
4.1.6.2	IPv4	-
37.7.2.2	IPv4	-
14.9.7.6	IPv4	-
4.5.6.2	IPv4	-
23.22.52.38	IPv4	-
2.2.6.5	IPv4	-
2.3.9.6	IPv4	-
10.1.9.34	IPv4	-
7.74.75.75	IPv4	-
10.74.76.43	IPv4	-
4.15.88.22	IPv4	-
10.6.2.8	IPv4	-
4.62.85.77	IPv4	-
7.21.27.25	IPv4	-
55.51.88.71	IPv4	-
1.69.87.48	IPv4	-
4.6.38.13	IPv4	-
1.13.49.4	IPv4	-
27.23.79.15	IPv4	-
8.92.15.75	IPv4	-
1.4.5.2	IPv4	-
1.8.1.2	IPv4	-
1.3.2.5	IPv4	-
12.7.3.2	IPv4	-
4.5.7.9	IPv4	-
10.8.1.1	IPv4	-
12.5.1.1	IPv4	-
1.2.2.3	IPv4	-
1.3.3.3	IPv4	-
2.5.5.5	IPv4	-
4.9.5.5	IPv4	-
6.3.2.6	IPv4	-
1.31.79.79	IPv4	-
2.79.79.79	IPv4	-
5.5.28.39	IPv4	-
2.88.48.48	IPv4	-
5.1.3.2	IPv4	-
44.9.7.9	IPv4	-

Showing 1 to 76 of 80 rows

Rows per page:

1.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

It's stealing your cookies from all sites!

M“

Michał “Foxbond” Chraniuk·6 Mar 2023

This extension is now malware. Every time you load a webpage it will send your cookies for that site to the developer. They will be able to access all your accounts using your existing sessions without logging in. If you have this extension installed, remove it immediately. Then go to every website you may be signed into and click sign out. That will end the sessions that have been compromised. After that, go back and change all of your passwords.

Bob Smith·6 Mar 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Get cookies.txt

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating