Security Alert: Confirmed Malware
IDM- integration addon
ID: pekpblgmdlmdpmleogokpeahkhginkab
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Dev. GroupView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
IDM integration - adds "Download with IDM" context menu item for the file links
Internet Download Manager ( IDM ) is a popular tool to increase download speeds by up to 5 times, resume and schedule downloads. Comprehensive error recovery and resume capability will restart broken or interrupted downloads due to lost connections, network problems, computer shutdowns, or unexpected power outages. This Chrome extension requires that Internet Download Manager ( IDM ) desktop application is installed. Integration module adds "Download with IDM" context menu item for the file links and displays Download panel over page-embedded multimedia content, providing various helper functions to the main application as well. Internet Download Manager can be downloaded and installed from the official website: http://www.internetdownloadmanager.com/ If you like Internet Download Manager - Please leave Review and 5*****.
This code packages large amounts of request metadata for export: request headers, response headers, POST bodies, cookies/origin context, user agent, and even proxy authorization material. It then forwards the bundle through `O(...)`, which elsewhere sends data to the companion process/backend, making this a direct browser-to-external-process data exfiltration path.
l = [p, q, Math.floor(r / 1E3), Math.floor(r % 1E3 * 1E3), l & 7, a, b.tabId, b.frameId];p = {};p[6] = Ib(g, k && 4 > a);p[17] = b.Y;p[4] = b.A;p[100] = b.P;p[8] = C;p[129] = B;p[122] = this.m;p[11] = tc(m);p[13] = tc(z);p[18] = tc(e);b.f && (p[14] = hc(b.f, Z(m, "Content-Type")));b.H && (p[19] = hc(b.H, Z(e, "Content-Type")));if (null == m) { a = this.s; g = b.tabId + "," + b.frameId; do g = (k = a[g]) && k.c, k = k && k.o, "about:blank" == k && (k = null); while (!k && g); p[50] = k; p[51] = f; p[54] = navigator.userAgent}x && (p[122] = ub(this, b.proxyInfo, Z(m, "Proxy-Authorization")), p[55] = ub(this, b.$, Z(e, "Proxy-Authorization")));if (!b.ca || !b.v) if (b = this.a[b.tabId]) p[7] = b.o;return O(this, 13, 1, c, l, p, d)The content script injects an extension-controlled script into every page context and all frames at document start, then enumerates inline scripts and sends matching script HTML back to the extension. Injecting into the page context plus harvesting script contents is a strong code-injection and page-surveillance pattern.
f.s = function() { if (!this.Fa) { this.Fa = !0; this.b(2, window, "message", this.qb); var b = document.createElement("script"); b.src = browser.extension.getURL("document.js"); b.onload = b.remove.bind(b); document.head.appendChild(b) }};f.J = function(b) { var a = this.a, c; for (c of document.getElementsByTagName("script")) !c.src && b.test(c.innerText) && a.postMessage([34, null, -1, c .outerHTML ]); a.postMessage([34, this.l()])The background page installs blocking `webRequest` handlers across `*://*/*`, including access to request bodies, request headers, and response headers. This gives the extension full interception capability over most browsing traffic, which is a high-risk pattern when combined with its later forwarding of captured data.
const c = ["blocking"], d = u && !oa && 1207959552 <= y ? ["extraHeaders"] : [];a.I(4, browser.webRequest.onBeforeRequest, a.La, { urls: Ea, types: Aa}, c);a.I(4, browser.webRequest.onBeforeRequest, a.La, { urls: G, types: b}, ["requestBody"]);a.I(4, browser.webRequest.onBeforeSendHeaders, a.vb, { urls: G, types: b}, ["requestHeaders"].concat(c, d));a.I(4, browser.webRequest.onHeadersReceived, a.xb, { urls: G, types: b}, ["responseHeaders"].concat(c));a.I(4, browser.webRequest.onResponseStarted, a.yb, { urls: G, types: b});a.I(4, browser.webRequest.onErrorOccurred, a.wb, { urls: G, types: bThe extension opens a WebSocket to localhost and, if that fails, falls back to native messaging with `com.tonec.idm`. Native messaging is a privileged bridge out of the browser sandbox, so combined with the captured network/page data above it creates a high-risk path for unrestricted local processing or onward exfiltration.
n.na = function() { var a = this.S % (F.length + 1); if (a < F.length) this.A = a = new WebSocket("ws://" + F[a] + "/?cid=" + Math.random() .toString() .substr(2, 9), "plugin.v3.internetdownloadmanager.com"), a.onopen = this.pa, a.onclose = this.N, a.onmessage = this.pb, 1 == a.readyState ? this.pa() : 3 == a.readyState && this.N(); else if (w) this.N(); else { this.da = a = browser.runtime.connectNative("com.tonec.idm"); try { a.postMessage("") } catch (b) { a = null } a ? (a.onDisconnect.addListener(this.N), a.onMessage.addListener(this.cb), this.pa()) : this.N() }The extension queries other extension IDs via the `management` API and disables them, and in one branch even disables itself. Programmatically turning off other installed extensions is atypical for a download helper and can be used to suppress competing tools, interfere with analysis, or alter the user's browser environment without consent.
n.Aa = J[J.length] = function wc(a, b, c, d, e) { var h = ia && "llbjbkhnmlidjebalopleeepgdfgcpec" == browser.runtime.id && "ngpampappnmepgilojfohadhhmbhlaek"; if (!a) return this.ma = !1, browser.storage.local.get("version", b = R()), (x ? 1124073472 <= y : w ? 1073741824 <= y : 1) && browser.extension.isAllowedIncognitoAccess(c = R()), u && browser.management.get( "jeaohhlajejodfjadcponpnjgkiikocn", d = R()), ia && browser.management.get(h || "llbjbkhnmlidjebalopleeepgdfgcpec", e = R()), S(wc, this, !0, b, c, d, e); N(d) && d.enabled && browser.management.setEnabled(d.id, !1); N(e) && e.enabled && browser.management.setEnabled(h || browser.runtime.id, !1);By severity
Versions scanned
Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.0.3 | 8 |
| 0.0.2 | 5 |
Files with findings
3 distinct paths โ top paths by unique finding count:
- background.js10
- content.js2
- document.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.