Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: InstantRadioPlay for Chrome

CRITICAL RISKRemoved from Chrome Web Store

InstantRadioPlay for Chrome

ID: gichihbmdneacehpcblhikedaliklfag

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇹Italian

🇯🇵Japanese

🇲🇽Latin American Spanish

🇵🇹Portuguese

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

13.990.19.63828

Size

0.38 MB

Rating

2.4/5

Reviews

Users

152,207

Type

Extension

Updated

Apr 24, 2021

Publisher Contextual Analysis

Author: http://instantradioplay.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

152,207

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Listen to your favorite radio stations directly from your PC with InstantRadioPlay with this Chrome New Tab Extension.

Get InstantRadioPlay, listen to any radio at any time, plus update your new tab page search to MyWay.com. Comes with daily content to show you news, weather and more in a new Chrome window! By installing this extension, you agree to the End User License Agreement and Privacy Policy (https://eula.askapplications.com/eula/) This new tab extension is a product of Ask Applications, Inc. Permissions Requested : "Read and change your data on a number of websites" For our product to work, we require access to the websites we own and manage. "Replace the page you see when opening a new tab" This allows us to show you our product - new tab page with free web search. "Read your browsing history" This allows us to tailor product specific content or offers towards relevant information. "Display notifications" This allows us the option to send you updates or additional product offers once you’ve already enjoyed the free product. "Manage your apps, extensions, and themes" This allows us to help you disable or remove this product and also understand whether we are able to provide the best experience. Release Log: 13.962 : Optimizes the sync of this extension between Chrome profiles.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High9

Medium5

Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
13.962.19.39176 Code review	16

Extension Version	Code Review Findings
13.962.19.39176	16

Files with findings

12 distinct paths — top paths by unique finding count:

js/babTypeInjectionScript.js2
js/dlp.js2
js/dlpHelper.js2
js/watchExtensionsHandler.js2
js/B2BService.js1
js/babRemoteConfigProcessor.js1
js/extensionDetect.js1
js/extensionDetectWithHash.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	js/babTypeInjectionScript.js (line 50)	The extension fetches arbitrary JavaScript from a remote URL (babRemoteScriptUrl from build vars) at runtime and immediately injects it into the active tab via chrome.tabs.executeScript with runAt: 'document_start'. T…	13.962.19.39176
2	Remote Code Loading	critical	js/babTypeInjectionScript.js (line 50)	This handler explicitly calls `initRemoteScript(...)`, then injects `_this.remoteScript` into the active tab with `chrome.tabs.executeScript` at `document_start`. Because the script body is downloaded from a remote UR…	13.962.19.39176
3	Data Exfiltration	high	js/dlpHelper.js (line 4)	DlpHelper silently injects an invisible iframe into the background page pointing at a remote download domain URL. When the injected content script in that iframe connects back via chrome.runtime, the background script…	13.962.19.39176
4	Data Exfiltration	high	js/offerService.js (line 136)	The OfferService periodically polls a remote server-controlled URL (offerServiceConfigUrl from build vars), receives a dynamic offerURL in the response, and forcibly opens it in a new browser tab without any user inte…	13.962.19.39176
5	Remote Code Loading	high	js/babRemoteConfigProcessor.js (line 14)	The extension loads a remote configuration from babConfigUrl and then silently injects an iframe (babIframeToProxy) into the background page pointing at a server-controlled proxyUrl. This iframe acts as a message prox…	13.962.19.39176
6	Tracking	high	js/dlp.js (line 46)	getParamsFromHash issues chrome.tabs.query({}) to enumerate every open tab and then calls chrome.webNavigation.getAllFrames on each tab to inspect the full URL including hash fragments. All tab URLs across every open …	13.962.19.39176
7	Tracking	high	js/extensionDetectWithHash.js (line 41)	This logic watches completed navigations, inspects frame URLs for matching hash parameters, then sends a tracking payload containing partner IDs, toolbar ID, version, language, and campaign fields to a remote DLP endp…	13.962.19.39176
8	Unauthorized Data Collection	high	js/localStorageContentScript.js (line 9)	This content script (injected into https://download.instantradioplay.com/blank.jhtml) exposes a command that reads every key from window.localStorage and returns the full contents to the background script on demand. W…	13.962.19.39176
9	Unauthorized Data Collection	high	js/dlp.js (line 307)	The extension uses the cookies permission to call chrome.cookies.getAll against the download domain and harvests all cookies into a tracking data object. The parsed cookie data (including toolbarId, partnerId, install…	13.962.19.39176
10	Unauthorized Data Collection	high	js/watchExtensionsHandler.js (line 1)	The extension enumerates all installed browser extensions via chrome.management.getAll and then registers permanent listeners on management.onInstalled, onUninstalled, onEnabled, and onDisabled to track every future e…	13.962.19.39176
11	Unauthorized Data Collection	high	js/dlpHelper.js (line 4)	The background page creates a hidden iframe to a remote URL, waits for that iframe-backed content script to connect, and immediately requests storage data from it. This is a deliberate harvesting workflow for site dat…	13.962.19.39176
12	Phishing	medium	js/notificationService.js (line 220)	The extension opens `notification.linkUrl` in a new tab when a user clicks a notification and logs the interaction back to its telemetry pipeline. Earlier in the same file, notification definitions are loaded from a r…	13.962.19.39176
13	Tracking	medium	js/extensionDetect.js (line 117)	When injected into extension-detect pages, the content script sets two Mindspark tracking cookies (mindsparktb_ and mindsparktbsupport_ prefixed with the toolbarId) on the visited page's domain. These cookies act as p…	13.962.19.39176
14	Tracking	medium	js/B2BService.js (line 4)	B2BService fires invisible tracking beacon images every 8 hours (PhoneHome) and at install time to tbapi.search.ask.com and apnanalytics.com. Each beacon encodes the user's partner ID, toolbar ID, partner sub ID, inst…	13.962.19.39176
15	Tracking	medium	js/ul.js (line 131)	The firePixel function loads arbitrary URLs via invisible iframes appended to document.body, used to fire tracking pixels (install pixel, live ping) to remote analytics endpoints. Unlike a simple Image beacon, an ifra…	13.962.19.39176
16	Unauthorized Data Collection	medium	js/watchExtensionsHandler.js (line 27)	Using the `management` permission, the extension enumerates other installed extensions, records their IDs, versions, enabled state, and whether they compete for the new-tab override. Inventorying other extensions is a…	13.962.19.39176

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

181

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


ak.staticimgfarm.com	/images/webtooltab/assets/logos/	https://ak.staticimgfarm.com/images/webtooltab/assets/logos/
35.190.68.37	-	http://35.190.68.37
localhost	-	http://localhost:8080
api.dynamicbuttons.vicinio.com	-	https://api.dynamicbuttons.vicinio.com
ak.staticimgfarm.com	/images/webtooltab/assets/searchbar/green_magnifying_glass.png	https://ak.staticimgfarm.com/images/webtooltab/assets/searchbar/green_magnifying_glass.png
iac_banner.tiles.ampfeed.com	-	https://iac_banner.tiles.ampfeed.com
www.accuweather.com	/coronavirus	https://www.accuweather.com/coronavirus?partner=web_askapp_adc
ak.staticimgfarm.com	/images/webtooltab/assets/down-arrow.png	https://ak.staticimgfarm.com/images/webtooltab/assets/down-arrow.png
ak.staticimgfarm.com	/images/webtooltab/assets/searchbar/223754551.png	https://ak.staticimgfarm.com/images/webtooltab/assets/searchbar/223754551.png
eula.askapplications.com	/eula/	https://eula.askapplications.com/eula/

Showing 1 to 10 of 190 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


35.190.68.37	IPv4	-

2.3 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

good

Roberto Carcabuso·8 Nov 2020

ADDS ABOUT TEN LINKS TO YOUR CHROME, NOT 1. Totally hijacks the entire links bar.

Albert Batista·27 Sept 2020

IT DOESNT DO ANYTHING DONT GET IT!!!

TurnerO·18 Sept 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

InstantRadioPlay for Chrome

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 4 Versions16

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews