Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Image Downloader

CRITICAL RISKRemoved from Chrome Web Store

Image Downloader

ID: djlbpfldklgbbcndolfjibbhegnmnmho

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.0.3

Size

0.25 MB

Rating

4.6/5

Reviews

Users

77,244

Type

Extension

Updated

Dec 1, 2023

Publisher Contextual Analysis

Author: Top DownloadersView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

167,265

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Easy download images while browsing on the web

How to use： - Go to the any website with images - Click on Image Downloader button in browser panel - Select image/images to download Why this image downloader? - Unlimited downloads - No ads - No sponsored links - Completely free - Download instantly at your highest speed - Works on multiple operating systems (Windows, Mac OS and Linux) - No need to install additional software Features With this Image Downloader you can find, browse and download all the images of any web page. In addition you can: - Filter by pixel width and height - Bulk download all images in once - Select what images you want to download - Check the size of each image - Copy the url of the original image - Supporting all popular websites (Instagram, Facebook, Twitter, ...) - Supports many formats including PNG, JPEG, SVG, WEBP Powerful image downloader tool that enables you to download all images from any website, Google Images. Download all images from Pinterest and Instagram! This extension will save you a lot of time if you need to download images regularly! FAQ Why does this extension need access to all my site data? In order to extract images from a web page, Image Downloader needs to be able to read all the content on that web page when you open the popup. No data leaves your computer. Why did this extension download smaller images than I expected? Why did it miss some images? Image Downloader can only extract the images currently visible on the page. Those may sometimes be smaller thumbnails of the full-resolution images you'd expect to see when you click on a photo (e.g. in Facebook albums). In addition, some websites like Instagram have carousels with multiple images, but only load a few at a time to save bandwidth.

User Growth

Showing data from Oct 09, 2022 to Oct 08, 2023

Versions

+41.08%(+22,494 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 5 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High6

Medium1

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.2 Code review	11

Extension Version	Code Review Findings
1.0.0.2	11

Files with findings

4 distinct paths — top paths by unique finding count:

js/background.js7
js/provider.js2
js/connector.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.js (line 375)	Generic fetch proxy: the service worker issues arbitrary HTTP requests to any URL with any method/body/headers on behalf of the sandbox, bypassing the page's own CORS and origin restrictions, and streams the response …	1.0.0.2
2	Network Interception	critical	js/background.js (line 109)	Installs declarativeNetRequest rules whose header list is read from chrome.storage.local key 'dnl_settings', which is populated from a remote server (see provider.js). This means the attacker's server can dictate arbi…	1.0.0.2
3	Privilege Escalation	critical	js/background.js (line 301)	Generic chrome_api bridge: the service worker walks an attacker-supplied 'api_chain' array on the global chrome object and invokes whatever function it lands on with attacker-supplied 'params'. Combined with the conne…	1.0.0.2
4	Remote Code Loading	critical	js/provider.js (line 153)	The sandboxed provider script, loaded into every http(s) page via a hidden iframe, fetches remote JSON from imagedown.site and stores it as 'dnl_settings' in extension storage. The background script then converts that…	1.0.0.2
5	Obfuscation	high	js/provider.js (line 177)	The provider only calls back to imagedown.site when the sandbox iframe is embedded from a non-extension origin (i.e. when injected into real user web pages), not when opened for developer/testing. This origin gating i…	1.0.0.2
6	Privilege Escalation	high	js/connector.js (line 49)	A content script injected into every visited http(s) tab creates a hidden sandbox iframe and forwards ALL window 'message' events from the page into the extension service worker without any filter on event.origin or m…	1.0.0.2
7	Privilege Escalation	high	js/background.js (line 218)	Persisted 'destructor' callbacks stored in chrome.storage.local ('d_cbs') are replayed as arbitrary chrome.* API invocations on every port disconnect. Because storage writes flow through the remote-driven sandbox prov…	1.0.0.2
8	Remote Code Loading	high	manifest.json (line 12)	The sandbox page CSP permits 'unsafe-eval', 'unsafe-inline', and blob: script-src-elem. The sandbox is where remote-fetched configuration is handled, so these relaxations enable execution of code constructed from remo…	1.0.0.2
9	Tracking	high	js/background.js (line 94)	Uses the cookies permission plus webRequest header inspection on requests to imagedown.site to write a tracking cookie based on an 'x-retpath-y' request header signalling cross-site origin. This is a cross-site user/d…	1.0.0.2
10	Unauthorized Data Collection	high	js/background.js (line 252)	Silently injects the connector content script into any open http(s) tab (not just the user's active tab and not in response to user action) to guarantee a persistent bridge between the remote-configured sandbox and th…	1.0.0.2
11	Tracking	medium	js/background.js (line 3)	On install, force-opens a page on the unrelated third-party domain ty-page.pro/ty/image_downloader. This is not the developer's support site and is a classic install-attribution / affiliate tracking beacon used to mon…	1.0.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
thank-y-p.com	/ty/image_downloader	https://thank-y-p.com/ty/image_downloader
imagedown.site	-	https://imagedown.site/
imagedown.site	/*	https://imagedown.site/*
imagedown.site	/img_d/	https://imagedown.site/img_d/

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.3	IPv4	-

4.5 out of 5 · 4 most recent reviews

Text reviews

Positive

Negative

Its nice

Khalid Mahmood·22 Dec 2023

Nice

Dário Ambrósio·2 Dec 2023

best downloader for image

Fakhar I Alam·2 Dec 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Image Downloader

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating