InterAlt

`loadScript` dynamically injects <script> tags from a URL into the document head. It is fed values derived from server responses fetched from `webapi.interalt.net`, and in this context also pulls an external CDN script (libphonenumber-js from jsdelivr) at runtime. This enables remote-controlled JavaScript execution inside the extension's side-panel iframe: whoever controls the server (or a man-in-the-middle) can change behavior post-install.

loadScript(url) {    var script = document.createElement('script');    script.src = url;    script.type = 'text/javascript';    document.head.appendChild(script);  }  ...  if (key == 'style' && app.is_load == false && postData.return.content.stylepick == false) {    app.loadScript('js/ic-sidenav-init.js');    app.loadJSONToLocalStorage(value);    try {      new icSettings(JSON.parse(value));      Codebyte.init();    } catch (error) {    }    app.loadScript('js/styleSwitcher.js');

The entire app UI (menus, templates, translations, settings, form schemas) is sourced from the hard-coded remote endpoint `webapi.interalt.net`, and HTML fragments returned by that endpoint are inserted with `insertAdjacentHTML` / `innerHTML` (e.g., `loadTemplates`, `controllerVarConverterOne`, `check_and_insert_slider`). Server-controlled HTML/JS templates rendered via innerHTML inside the extension UI effectively give the remote server the ability to alter the side-panel at will, including loading additional scripts.

const app = new Interface('https://webapi.interalt.net');app.loadTemplates(true, function() {  app.loadMenu(function() {    app.loadSubmit(function() {      app.change_url();    });  });});window.addEventListener('hashchange', app.change_url);

On install the extension opens a tab to, and on uninstall it pings, a third-party domain `cloudapi.stream` that is unrelated to the vendor domain `interalt.net`. The `?action=interalt` query parameter is an affiliate/attribution marker, indicating covert install/uninstall tracking routed through an external monetization/telemetry service.

chrome.runtime.setUninstallURL("https://cloudapi.stream/uninstall/?action=interalt"),  chrome.runtime.onInstalled.addListener((function(t) {    "install" === t.reason && (chrome.tabs.create({        url: "https://cloudapi.stream/install/?action=interalt"      }), Object(u.b)()      .then((function() {        u.a.dispatch("SET_INSTALL_DATE", Date.now())      })))  }))

The extension generates a random per-install user identifier (mixed-case base36 string) and persists it in chrome.storage. Combined with install-date tracking and the third-party install/uninstall pings, this produces a stable pseudonymous identifier that enables cross-session tracking of each user.

u.a.state.storage.user.id || u.a.commit("SET_USER_ID", function() {  for (var t = Math.random()      .toString(36)      .substr(2, 9) +      Date.now()      .toString(36)      .substr(3), e = 0; e < t.length; e++)    Math.random() > .5 && (t = t.substr(0, e) + t[e].toUpperCase() +      t.substr(e + 1));  return t}())

The background message handler blindly opens any URL passed in `t.link` via `chrome.tabs.create/update` and passes any URL to `chrome.downloads.download` without origin or schema validation. Any page or iframe able to reach this listener (including the loaded `app/index.html` iframe, which itself pulls remote content from `webapi.interalt.net`) can trigger arbitrary navigation or file downloads, enabling phishing redirects or drive-by downloads.

chrome.runtime.onMessage.addListener((function(t, e, n) {  switch (t.action) {    case "open-link":      var r = t.link;      if (t.newPage) return void chrome.tabs.create({        url: r      });      f({        url: r      }).then((function(t) {        t.length ? chrome.tabs.update(t[0].id, {            active: !0          }) :          chrome.tabs.create({            url: r          })      }));      break;      ...    case "download":      chrome.downloads.download({        url: t.url      })  }}))

The side-panel app loads JavaScript from an external CDN (jsdelivr.net) at runtime. Remote-hosted code is not reviewed by the Web Store, can change at any time, and violates MV3 best practices that require code to be bundled with the extension.

<script src="https://cdn.jsdelivr.net/npm/libphonenumber-js/bundle/libphonenumber-js.min.js"></script>

Every HTML form marked `data-submit=true` (including the contact form capturing name, email, phone, budget, and free-text message) is serialized and POSTed to `webapi.interalt.net`. Although this is the vendor's own domain, the extension harvests personal contact data from users into a remote backend without an in-manifest privacy notice and without restricting host access.

elements_global[i].addEventListener('submit', async function(event) {        event.preventDefault();        ...        let form = app.serializeForm(event.target);        form.action = 'submit';        let postData = await app.client.post('/', form);        console.log('POST response:', postData);        app.submit_success(postData.return);