Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: GitHub加速

CRITICAL RISKRemoved from Chrome Web Store

GitHub加速

ID: ffjjnphohkfckeplcjflmgneebafggej

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

1.5.10

Size

0.07 MB

Rating

4.2/5

Reviews

Users

40,143

Type

Extension

Updated

Nov 16, 2022

Publisher Contextual Analysis

Trusted

Author: HelloWorldView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

168,378

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

国内Github下载很慢，用上了这个插件后，下载速度嗖嗖嗖的~！’

用途： 1. 下载文件的速度会有一定的提升 2. 部分用户可能使用了也没有什么效果注意： 1. 这个加速效果很玄学，有可能提升很明显，有可能毫无效果； 2. 如果没有什么效果，可以卸载该插件； 3. 该插件无法加快您访问基特哈波网站的速度；

User Growth

Showing data from Jan 11, 2022 to Jan 10, 2023

Versions

-35.34%(-21,939 users)

Compared to 3 months ago

6 versions released in this period

Rating Count

Total: 11 ratings

Average Rating

Current: 4.45 / 5.0+4.45

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High2

Medium2

Low1

Versions scanned

Showing 1 of 6 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.5.6 Code review	5

Extension Version	Code Review Findings
1.5.6	5

Files with findings

2 distinct paths — top paths by unique finding count:

content/index.js4
background/index.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	high	content/index.js (line 110)	When the user clicks the injected 'Download ZIP' button, the extension redirects the browser to a third-party mirror host (default https://gh.api.99988866.xyz/, configurable) prefixed to the real github.com download U…	1.5.6
2	Remote Code Loading	high	content/index.js (line 116)	On every github.com page load (via MutationObserver), the extension fetches an attacker-controlled JSON endpoint (yidian.one/chrome/info.json) and injects the returned url/title/desc/color values into the GitHub DOM v…	1.5.6
3	Data Exfiltration	medium	content/index.js (line 30)	The content script walks every text node on github.com pages and forwards the text to the background service worker, which POSTs it to https://transmart.qq.com/api/imt (Tencent translation API). Although gated on the …	1.5.6
4	Data Exfiltration	medium	background/index.js (line 81)	Background service worker exfiltrates arbitrary text content received from the content script to transmart.qq.com (Tencent) in two sequential POSTs (lang_detect then auto_translation_block). The text payload originate…	1.5.6
5	Code Injection	low	content/index.js (line 87)	The extension constructs HTML strings containing values derived from the user's configured webIDE setting and href attributes pulled from the GitHub DOM, then injects them directly via insertAdjacentHTML across multip…	1.5.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
gh.api.99988866.xyz	-	https://gh.api.99988866.xyz/
transmart.qq.com	/api/imt	https://transmart.qq.com/api/imt
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
github.com	/conwnet/github1s	https://github.com/conwnet/github1s

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


138.112.25.25	IPv4	-

3.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

垃圾

左

左加菲·10 Nov 2023

没法用了吗？

p3ck3rw00d·18 May 2023

点击后自动跳转Chrome商店，没有之前的好用

xiaoshuai jia·18 Dec 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

GitHub加速

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 6 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating