Security Warning: Historically Flagged as Malware

This extension is historically labeled as malware, but the current version analysis does not yet confirm severe malicious findings.Extension: H2Home Extension

HIGH RISKStill available - needs review

H2Home Extension

ID: ighpdnoohnchfghplmmldgljjkdeioni

Supported Languages

🇵🇱Polish

Extension Info & Metadata

Status

Active

Version

1.3.0

Size

0.19 MB

Rating

5.0/5

Reviews

Users

443

Type

Extension

Updated

Jul 15, 2026

Publisher Contextual Analysis

Trusted

Author: h2home.plView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

443

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Extension for H2Home Service

H2Home Extension - jest jednym z narzędzi jakie daje architektom H2Home. Pozwala na wypełnianie projektów wnętrz produktami ze stron różnych dostawców i sklepów internetowych. Dzięki temu możesz tworzyć kompletne inspiracje i generować listy zakupowe dla swoich klientów. To proste - wejdź na stronę produktu, otwórz wtyczkę, wypełnij formularz danymi ze strony i zapisz. Wszystkie produkty możesz zobaczyć na swoim koncie na stronie h2home. Aby korzystać z wtyczki musisz być zalogowany na swoim koncie https://h2home.pl

User Growth

Showing data from Nov 24, 2023 to Nov 30, 2024

Versions

+1.36%(+6 users)

Compared to 3 months ago

9 versions released in this period

Rating Count

Total: 4 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium4

Low1

Versions scanned

Showing 1 of 12 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.7 Code review	9

Extension Version	Code Review Findings
1.2.7	9

Files with findings

3 distinct paths — top paths by unique finding count:

src/service-worker.ts.js5
src/content.ts.js3
src/content.ts-loader.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	high	src/service-worker.ts.js (line 810)	Opens arbitrary merchant URLs in background tabs and triggers automated interactions on behalf of the user without visible UI. Combined with the injected clicker (function K) this constitutes autonomous action on thir…	1.2.7
2	Privilege Escalation	high	src/service-worker.ts.js (line 741)	Injects a large scripted 'auto-click' function (K) into arbitrary third-party tabs. Function K scans the DOM for 'Add to cart / Dodaj do koszyka' buttons across multiple languages and clicks them up to 5 times with fo…	1.2.7
3	Privilege Escalation	high	src/service-worker.ts.js (line 590)	Heuristic cart-button finder using label/aria/class token matching in English and Polish, executed in arbitrary tabs and allowed to click the matched button repeatedly. The scoring/matching is aggressive (partial-labe…	1.2.7
4	Privilege Escalation	high	src/content.ts.js (line 283)	Exposes a window-event bridge ('h2home-extension:request') that lets page-level JavaScript issue ADD_TO_CART commands to the extension, which then opens tabs and auto-clicks buttons on arbitrary merchants. Although th…	1.2.7
5	Credential Theft	medium	src/service-worker.ts.js (line 520)	Collects email and password in the service worker and POSTs them to https://api.app.h2home.pl/Identity/Account/LoginExt. The endpoint is the vendor's own API (legitimate use case), but the extension accepts raw creden…	1.2.7
6	Unauthorized Data Collection	medium	src/content.ts.js (line 83)	Content script runs on every http/https page (matches ':///*') and harvests og:/product:/kis: meta tags, JSON-LD Product nodes, title, images, price, currency, SKU and the full URL. Harvested data is forwarded to th…	1.2.7
7	Unauthorized Data Collection	medium	src/content.ts.js (line 470)	Invokes chrome.tabs.captureVisibleTab to screenshot the active tab, crops a user-selected region via a canvas, then ships the resulting data URL into the extension iframe. Combined with the broad host permission and c…	1.2.7
8	Unauthorized Data Collection	medium	src/service-worker.ts.js (line 1031)	Service worker exposes a CAPTURE_SCREENSHOT message handler that returns the current tab's pixels as a PNG data URL to the caller. Any frame running the extension's content script can request this without additional c…	1.2.7
9	Remote Code Loading	low	src/content.ts-loader.js (line 5)	Dynamic ES-module import via chrome.runtime.getURL. The target is bundled inside the extension (not remote), so this is not true remote code loading, but automated scanners flag dynamic import() inside content scripts…	1.2.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


tailwindcss.com	-	https://tailwindcss.com
react.dev	/errors/%60+e;if(1	https://react.dev/errors/`+e;if(1
www.w3.org	/2000/svg%60,a	http://www.w3.org/2000/svg`,a
www.w3.org	/1998/Math/MathML%60,a	http://www.w3.org/1998/Math/MathML`,a
www.w3.org	/2000/svg%60\|\|o.hasAttribute(%60itemprop%60	http://www.w3.org/2000/svg`\|\|o.hasAttribute(`itemprop`
www.w3.org	/1999/xlink%60,%60xlink:href%60,n	http://www.w3.org/1999/xlink`,`xlink:href`,n
www.w3.org	/1999/xlink%60,%60xlink:actuate%60,r	http://www.w3.org/1999/xlink`,`xlink:actuate`,r
www.w3.org	/1999/xlink%60,%60xlink:arcrole%60,r	http://www.w3.org/1999/xlink`,`xlink:arcrole`,r
www.w3.org	/1999/xlink%60,%60xlink:role%60,r	http://www.w3.org/1999/xlink`,`xlink:role`,r
www.w3.org	/1999/xlink%60,%60xlink:show%60,r	http://www.w3.org/1999/xlink`,`xlink:show`,r

Showing 1 to 10 of 50 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


3.138.75.75	IPv4	-

5.0 out of 5 · 6 most recent reviews

Text reviews

Positive

Negative

Świetne narzędzie, które znacząco ułatwia tworzenie list zakupowych. Intuicyjny interfejs sprawia, że korzystanie z aplikacji jest bardzo proste. Polecam!

Konrad Kontrabas·13 Jan 2025

Wtyczka bardzo upraszcza mi tworzenie list zakupowych, jest prosta i intuicyjna w obsłudze. Polecam!

Eliza R·21 Jul 2024

Ta wtyczka to prawdziwe ułatwienie w pracy architekta wnętrz ! Zdecydowanie zwiększyła mają produktywność w zarządzaniu projektami. Dużym plusem jest łatwy oraz przejrzysty dostęp do produktów. Polecam !

Marek Rybak

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Warning: Historically Flagged as Malware

H2Home Extension

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 12 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating