Security Alert: Critical Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: 二维码小能手

CRITICAL RISK

二维码小能手

ID: inkoacoebhbbfcidbbjognchggilmefm

Extension Info & Metadata

Status

Active

Version

0.0.5

Size

0.10 MB

Rating

5.0/5

Reviews

Users

90,000

Type

Extension

Updated

Sep 5, 2022

Publisher Contextual Analysis

Author: llrenfubView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: Yes
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

90,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

二维码小能手可以方便将网页转换为二维码，是一款简单、实用、高效、便捷的二维码扫描及生成的应用。

二维码小能手是可以方便地把电脑浏览器访问的网址，生成二维码，用手机扫描后，可以在手机上方便的访问。功能介绍： - 当访问当前页面时，点击下插件图标，会生成二维码 - 手机扫描后可以方便访问

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-10%(-10,000 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High2

Medium2

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.5 Code review	7

Extension Version	Code Review Findings
0.0.5	7

Files with findings

2 distinct paths — top paths by unique finding count:

serviceworker.js6
js/contentscript.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	serviceworker.js (line 2392)	Every time a redirect rule fires, the extension exfiltrates the full referer URL of the user's navigation along with a persistent device fingerprint (dc), campaign/rule identifiers, and the extension version to http:/…	0.0.5
2	Network Interception	critical	serviceworker.js (line 2418)	For each remote-supplied rule the extension installs a main_frame redirect that either sends the user to an operator-controlled URL or injects/overwrites query-string parameters (typically used for affiliate/traffic-m…	0.0.5
3	Remote Code Loading	critical	serviceworker.js (line 2510)	The service worker fetches an AES-encrypted configuration blob from http://api.qrstrategy.com/sr105/qrinfo, decrypts it with the hardcoded key, and uses the resulting JSON (regex filters, redirect URLs, query-param ov…	0.0.5
4	Obfuscation	high	serviceworker.js (line 2335)	Hardcoded AES-CBC key ("D96C445CAB84B110") with IV == key is used to encrypt every outbound request and decrypt every inbound response from http://api.qrstrategy.com. The only purpose of this custom crypto wrapper (on…	0.0.5
5	Tracking	high	js/contentscript.js (line 1372)	The content script (injected into every page via :///*) bundles FingerprintJS v3.3.2 to compute a cross-site browser fingerprint (canvas, plugins, screen, userAgent, and many other signals gathered earlier in the fi…	0.0.5
6	Other	medium	serviceworker.js (line 2335)	The C2 endpoint api.qrstrategy.com is contacted over plaintext HTTP rather than HTTPS. Combined with the custom-AES envelope this hides the payload contents but also means any network observer can see the extension be…	0.0.5
7	Tracking	medium	serviceworker.js (line 2546)	The device fingerprint is persisted in chrome.storage.sync under key "brext", which means it also synchronizes via the user's Google account across every Chrome profile they sign into. This produces a stable, account-…	0.0.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
api.qrstrategy.com	-	http://api.qrstrategy.com
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
reactjs.org	/link/react-polyfills	https://reactjs.org/link/react-polyfills
r88.vn	-	https://r88.vn/

Showing 1 to 10 of 50 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

Explore new opportunities with us to increase revenue and expand your chrome extension. See how we can help you. Details at: https://extensionbuysell.com We are looking forward to working with you! Best regards,

Madison Francis·19 Sept 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Critical Security Risk

二维码小能手

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating