Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 券多多

CRITICAL RISKRemoved from Chrome Web Store

券多多

ID: ieihjhlhfjkdkfjhpjfgeleegmnmjbcg

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

0.0.8

Size

0.11 MB

Rating

1.0/5

Reviews

Users

80,000

Type

Extension

Updated

Nov 20, 2022

Publisher Contextual Analysis

Author: llrenfuaView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

80,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

当您在京东或者淘宝浏览商品详情页时，为您获取该商品的优惠券，领取优惠券后下单立减。

券多多是一款帮助用户快捷获取京东商品优惠券的浏览器插件。功能介绍：参考商品链接： https://item.jd.com/65686973921.html 1、当您在京东商品详情页浏览商品时，会获取该商品隐藏的优惠券 2、如果该商品无优惠券，会推荐相似款价格 3、点击立即领取按钮，如果该商品有优惠券，到领券页面，可以使用该券省钱，否则会跳转到该商品的移动页面，方便用户购买

User Growth

Showing data from Jan 01, 2022 to Jan 02, 2023

Versions

-22.22%(-20,000 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 1.00 / 5.0+1.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium2

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.7 Code review	6

Extension Version	Code Review Findings
0.0.7	6

Files with findings

3 distinct paths — top paths by unique finding count:

js/contentscript.js4
js/components.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	js/contentscript.js (line 208)	Remote server data (`couUrl`, `similarDesc`, `couPrice`, thumb/title/url fields in the similar-items and recList loops) is interpolated directly into an HTML string and injected into the DOM via jQuery `.before()` wit…	0.0.7
2	Phishing	high	js/contentscript.js (line 333)	When the user clicks a coupon, the extension calls the remote `/wv102/lucvt` endpoint, base64-decodes the response and blindly passes the returned `url` field to `window.open()`. This hands full navigation control of …	0.0.7
3	Privilege Escalation	high	manifest.json (line 28)	The content script declares a match pattern of `:///*`, injecting contentscript.js (and its jQuery/base64 libraries plus network-fetch logic) into every website the user visits. This is wildly broader than the state…	0.0.7
4	Unauthorized Data Collection	high	js/contentscript.js (line 311)	On every JD/Taobao/Tmall product page the extension extracts the product ID (`h`), page title (`g`) and platform, base64-encodes the JSON payload, and POSTs it to a third-party server (`pfsapi.qmpdf.com`). This is sil…	0.0.7
5	Obfuscation	medium	js/contentscript.js (line 388)	Both outbound requests and inbound responses are base64-encoded JSON rather than plain JSON. Encoding is done with a bundled base64 polyfill (module 795) and payloads are opaque on the wire. This is low-effort obfusca…	0.0.7
6	Other	medium	js/components.js (line 4068)	`js/components.js` is a near-identical duplicate of `contentscript.js` (same `pfsapi.qmpdf.com` endpoints, same base64 request/response, same DOM injection logic) but is not referenced anywhere in `manifest.json`. Shi…	0.0.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
sizzlejs.com	-	https://sizzlejs.com/
js.foundation	-	https://js.foundation/
jquery.com	-	https://jquery.com/
jquery.org	/license	https://jquery.org/license
pfsapi.qmpdf.com	-	https://pfsapi.qmpdf.com
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

We are looking for a partnership to explore new sources of income for chrome extensions. We believe that this partnership can help your business grow stronger. See more at: https://extensionbuysell.com Looking forward to working with you! Best regards,

Madison Francis·16 Sept 2024

Hello, I hope you're having a splendid day! I am currently seeking opportunities to expand my business operations by investing in extensions with a significant user base, beginning from 50,000 users and up. No matter if your extension has a modest user base or counts its users in the millions, I am interested and ready to negotiate a purchase. If you are in possession of such an extension and looking to turn it into a profit, please consider reaching out to me. We can discuss the price and proceed with a transparent and secure transaction through a trusted escrow service based in the United States. It's great that Google allows the transfer of extension ownership between accounts, so your Google account ownership will remain intact. If you have any needs, please contact us via the following contacts Whatsapp: +1 (248) 896‑8035 Telegram: t.me/harryysandersonn

Abner Wirtz·7 Jun 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

券多多

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating