Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: IDM- integration addon

CRITICAL RISKRemoved from Chrome Web Store

IDM- integration addon

ID: pekpblgmdlmdpmleogokpeahkhginkab

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

0.0.4

Size

0.10 MB

Rating

2.9/5

Reviews

Users

534,830

Type

Extension

Updated

Nov 7, 2022

Publisher Contextual Analysis

Trusted

Author: Dev. GroupView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

534,830

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

IDM integration - adds "Download with IDM" context menu item for the file links

Internet Download Manager ( IDM ) is a popular tool to increase download speeds by up to 5 times, resume and schedule downloads. Comprehensive error recovery and resume capability will restart broken or interrupted downloads due to lost connections, network problems, computer shutdowns, or unexpected power outages. This Chrome extension requires that Internet Download Manager ( IDM ) desktop application is installed. Integration module adds "Download with IDM" context menu item for the file links and displays Download panel over page-embedded multimedia content, providing various helper functions to the main application as well. Internet Download Manager can be downloaded and installed from the official website: http://www.internetdownloadmanager.com/ If you like Internet Download Manager - Please leave Review and 5*****.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+167.42%(+334,830 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 34 ratings+4 (13%)

Average Rating

Current: 2.88 / 5.0-1.52

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High6

Medium3

Low1

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.3 Code review	8
0.0.2 Code review	5

Extension Version	Code Review Findings
0.0.3	8
0.0.2	5

Files with findings

3 distinct paths — top paths by unique finding count:

background.js10
content.js2
document.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	background.js (line 1467)	The function `P()` calls `browser.cookies.getAll({url})` to retrieve all cookies for a given URL, then `Q()` serializes them into a `name=value; name=value` string. This serialized cookie string is packed into field i…	0.0.3
2	Data Exfiltration	critical	background.js (line 1981)	This code packages large amounts of request metadata for export: request headers, response headers, POST bodies, cookies/origin context, user agent, and even proxy authorization material. It then forwards the bundle t…	0.0.2
3	Network Interception	critical	background.js (line 381)	The extension registers blocking `webRequest` listeners on all URLs (`:///*`) capturing request bodies, full request headers, and full response headers for every network request made by any tab. POST request bodies …	0.0.3
4	Code Injection	high	content.js (line 200)	The content script injects an extension-controlled script into every page context and all frames at document start, then enumerates inline scripts and sends matching script HTML back to the extension. Injecting into t…	0.0.2
5	Network Interception	high	background.js (line 454)	The extension establishes a persistent WebSocket connection to localhost ports 127.0.0.1:1001 or 0.1.0.1:1001 and falls back to native messaging (`connectNative('com.tonec.idm')`). All intercepted request/response dat…	0.0.3
6	Network Interception	high	document.js (line 1)	This script is injected into every page's DOM via `content.js` (appended to `document.head`) and monkey-patches `XMLHttpRequest.prototype.open` and the global `fetch` function. The patches intercept XHR/fetch response…	0.0.3
7	Network Interception	high	background.js (line 480)	The background page installs blocking `webRequest` handlers across `:///*`, including access to request bodies, request headers, and response headers. This gives the extension full interception capability over most …	0.0.2
8	Privilege Escalation	high	background.js (line 1407)	The extension uses the `management` permission to look up a competing IDM extension by ID (`jeaohhlajejodfjadcponpnjgkiikocn`) and, if found enabled, calls `browser.management.setEnabled(d.id, false)` to forcibly disa…	0.0.3
9	Privilege Escalation	high	background.js (line 641)	The extension opens a WebSocket to localhost and, if that fails, falls back to native messaging with `com.tonec.idm`. Native messaging is a privileged bridge out of the browser sandbox, so combined with the captured n…	0.0.2
10	Other	medium	background.js (line 2270)	The extension queries other extension IDs via the `management` API and disables them, and in one branch even disables itself. Programmatically turning off other installed extensions is atypical for a download helper a…	0.0.2
11	Tracking	medium	content.js (line 18)	On every page load and navigation event, the content script sends message type 21 containing the full current URL (`location.href`) and `document.referrer` to the background script, which forwards it to IDM. The page …	0.0.3
12	Unauthorized Data Collection	medium	background.js (line 388)	The extension reads the system proxy configuration on startup and subscribes to all changes via `browser.proxy.settings.onChange`. The extracted proxy mode, PAC script data/URL, and proxy server addresses are stored i…	0.0.3
13	Tracking	low	background.js (line 457)	Upon establishing connection to the IDM process (WebSocket or native messaging), the extension immediately transmits a fingerprint containing browser version (`D` / `y`), platform window class name (`ya`, e.g. `Chrome…	0.0.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-
0.1.0.1	IPv4	-

1.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Cuidado!!!!! após instalar essa extensão meu PC contraiu vírus e tentaram roubar meu e-mail... não instalem e denuncie para que seja retirado do google.

Gessé Rocha·27 Dec 2022

bullsh*t

Irwing Millan Garcia·25 Dec 2022

fake

Silver Taurus·

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

IDM- integration addon

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating