Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: i New Tab

CRITICAL RISKRemoved from Chrome Web Store

i New Tab

ID: hdkdmoacnkphoadmfidlhfdobieblphn

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.3.70

Size

0.94 MB

Rating

4.4/5

Reviews

613

Users

408,893

Type

Extension

Updated

May 22, 2019

Publisher Contextual Analysis

Author: https://www.freenewtab.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

408,893

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

EagleGet New Tab, a free new tab extension that make your new tab more productive.

The best Chrome new tab extension.improve your work efficiency ,manage your bookmarks in a brand new way ,visit your favorite websites in a single click,quickly search web history, view Facebook and Gmail notifications in a glance,more features are waiting you to discover, don't miss it, This one is for you! ★ Beautiful custom full screen backgrounds / wallpapers ★ Live customizable weather forecast ★ Easily re-arrange and disable sites ★ Live facebook/gmail notifications / messages so you don't waste time ★ Follow your favorite stocks with live customizable stock tickers ★ Easy access to manage apps, extensions, bookmarks and history ★ Google/bing/yahoo search ★ Top Tracks Daily News from Spotify ★ Top visited websites ★ Multiple layout options, single view and all in one ★ One click the collapse and recently opened tab features. ★ Follow any region news topic We're always working on new features, please use the support page to request features and please leave us a great review if you have a few minutes! Privacy Policy http://www.eagleget.com/privacy-policy/ EULA http://www.eagleget.com/eagleget-user-terms/

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High6

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.3.70 Code review	12

Extension Version	Code Review Findings
1.3.70	12

Files with findings

5 distinct paths — top paths by unique finding count:

script/itab.js6
script/background.js3
manifest.json1
script/contentscript.js1
script/ga.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Obfuscation	critical	script/itab.js (line 1)	The entire 96KB itab.js is wrapped in a custom eval()-based deobfuscator that decodes a backtick-compressed string at runtime. This technique is deliberately used to hide the file's true behavior from static analysis …	1.3.70
2	Tracking	critical	script/itab.js (line 1)	The Bing search engine entry is silently replaced with 'http://www.hbsohu.xyz/Results.aspx?GD=SY...&Source=69&UM=8' — a known affiliate/tracking domain. Every Bing search query typed into the extension's search bar is…	1.3.70
3	Unauthorized Data Collection	critical	script/contentscript.js (line 1)	The content script runs on every http/https page, sends the current page URL to the background script, receives back a screenshot URL, renders it onto an HTML5 canvas, and returns the full canvas pixel data (via toDat…	1.3.70
4	Unauthorized Data Collection	critical	script/background.js (line 1)	The HiddenCapture class creates a browser window positioned 100,000px off-screen (left:1e5, top:1e5, focused:false) so it is invisible to the user, navigates it to a target URL, resizes it to 1024x768, and uses chrome…	1.3.70
5	Unauthorized Data Collection	critical	script/background.js (line 1)	The background listens for 'thumb_hidden_capture' requests, invokes HiddenCaptureQueue to silently capture screenshots of arbitrary URLs, and writes the resulting images to '/snapshot/{id}.{ext}' in persistent storage…	1.3.70
6	Code Injection	high	manifest.json (line 30)	The manifest explicitly whitelists 'unsafe-eval' in its Content Security Policy, which is required to execute the eval()-based obfuscation present in itab.js and common.js. Legitimate extensions have no need for unsaf…	1.3.70
7	Privilege Escalation	high	script/itab.js (line 1)	The obfuscated itab.js invokes chrome.management.setEnabled() (partially visible despite obfuscation) to programmatically enable or disable other installed extensions. This constitutes privilege escalation: a new tab …	1.3.70
8	Remote Code Loading	high	script/itab.js (line 1)	The extension loads personalized 'recommended' content (links, wallpapers, top sites) from plugins.eagleget.com/index.php with a version identifier, locale, and timestamp on every new tab load. This remote content-loa…	1.3.70
9	Unauthorized Data Collection	high	script/itab.js (line 1)	The weather widget sends the user's city (derived from geolocation or user input) to 'http://plugins.eagleget.com/delivery_zip2.php' over unencrypted HTTP. The endpoint name 'delivery_zip2' is anomalous for a weather …	1.3.70
10	Unauthorized Data Collection	high	script/itab.js (line 1)	The extension phones home to 'http://plugins.eagleget.com/index.php' passing 'mt' (content type), 'ned' (navigator.language — user's browser locale), and a version identifier. This endpoint controls what content (news…	1.3.70
11	Unauthorized Data Collection	high	script/background.js (line 1)	On every popup open, the background retrieves the user's complete bookmarks tree via chrome.bookmarks.getTree() and the full list of recent tabs (with URLs), packaging them into the popup's initial data payload. Both …	1.3.70
12	Tracking	medium	script/ga.js (line 1)	Google Analytics is initialized with 'displayfeatures' enabled (ga("require","displayfeatures")), which collects demographic and interest category data from users for advertising purposes. Combined with the extension'…	1.3.70

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
chrome.google.com	/webstore/detail/i-new-tab/hdkdmoacnkphoadmfidlhfdobieblphn/reviews	https://chrome.google.com/webstore/detail/i-new-tab/hdkdmoacnkphoadmfidlhfdobieblphn/reviews
www.freenewtab.com	/privacy-policy/	https://www.freenewtab.com/privacy-policy/

Showing 1 to 10 of 50 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

very good like it

Evan William·7 Nov 2020

ممتاز وأكثر

Mahmoud Sadaawy·8 Oct 2020

بجنن

nasem omoor·7 Oct 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

i New Tab

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version12

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews