Security Alert: Confirmed Malware
HDify
ID: bbdengonknjdlnahehkamhbdlgmoicnp
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Nine SalmotasView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Auto HD quality for Youtube videos. Optimal video quality is selected based on your screen size.
HDify is an Auto HD extension that manages your Youtube video quality settings. HDify works automatically. The app selects the optimal video quality based on your screen resolution. How to use it: Just install. No settings, no popups, it just works.
The extension generates and persists a UUID-like client identifier (`cid`) in local storage, then transmits it to Google Analytics along with the extension runtime ID. This is a tracking pattern because it creates a stable per-install identifier and phones home to an external analytics endpoint without any visible user interaction.
async function o() { const e = await new Promise((e => { chrome.storage.local.get(["cid"], (t => { e(t) })) })); let { cid: t } = e; return t || (t = (0, n.v4)(), chrome.storage.local.set({ cid: t })), t}async function i(e) { const t = undefined, r = { v: "1", tid: e, cid: await o(), t: "pageview", dp: "/background", dt: "background", dh: `chrome-extension://${chrome.runtime.id}` }, n = `https://www.google-analytics.com/collect?${new URLSearchParams(r).toString()}`; await fetch(n, { method: "POST", body: "" })}This code enables runtime loading of extension locale data from a remote server when `t.remote` is set, constructing the URL from the page host and current locale. The same file initializes this with `remote: true` and `endpoint: "https://onlinesly.com"` at lines 3383-3387, meaning extension-visible text can be remotely changed after publication, which is a suspicious remote dependency even though it is JSON rather than executable script.
function O(e) { const t = e || {}; this.phrases = {}, this.gl = t.gl || top, this.extend(t.phrases || {}), this.currentLocale = t.locale || "en"; const r = t.allowMissing ? S : null; this.onMissingKey = "function" == typeof t.onMissingKey ? t.onMissingKey : r, this.warn = t.warn || l, this .tokenRegex = j(t.interpolation), this.pluralRules = t.pluralRules || h, t.remote && (this.req = n.default .get.bind(this, `${t.endpoint}/_locales/${document.location.host}/${this.currentLocale}.json`, { responseType: "json" }), A(this))}On installation, the background script queries all open tabs and injects the content script into every tab and every frame without checking the tab URL first. Given that the manifest already matches all HTTP and HTTPS pages at `document_start`, this is an overbroad injection pattern that unnecessarily expands the extension's reach across unrelated sites.
o.browser.runtime.onInstalled.addListener((async e => { if ("install" === e.reason) { const e = "js/content.js", t = await o.browser.tabs.query({}); for (const r of t) if (r.id) try { await o.browser.tabs.executeScript(r.id, { allFrames: !0, file: e }) } catch (e) {} } c()}));By severity
Versions scanned
Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.3.1 | 3 |
| 0.3.0 | 4 |
Files with findings
2 distinct paths — top paths by unique finding count:
- js/background.js5
- manifest.json2
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.