Security Alert: Confirmed Malware
Leetcode Hints
ID: lhgggocokbefnmgfkgomolfjhmmpooda
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- rushaan.chawlaView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
This extension would give you three hints when you are stuck on a problem rather than givign you a direct solution
Struggling with a tough LeetCode problem? Get the extra help you need with LeetCode Hint Helper! LeetCode Hint Helper is a must-have Chrome extension for all coding enthusiasts and competitive programmers. Whenever you open a LeetCode problem, this extension will provide you with up to three insightful hints to help you solve the problem efficiently. Key Features: Seamless Integration: Automatically detects when you're on a LeetCode problem page and activates instantly. Three Helpful Hints: Offers up to three progressive hints to guide you through solving the problem without giving away the complete solution. User-Friendly Interface: Hints are displayed in an unobtrusive sidebar, keeping your workspace clean and focused. Supports Various Problem Types: Whether you're tackling arrays, linked lists, dynamic programming, or any other topic, LeetCode Hint Helper has got you covered. How It Works: Install the Extension: Add LeetCode Hint Helper to your Chrome browser. Open a LeetCode Problem: Navigate to any LeetCode problem page. Receive Hints: The extension will automatically fetch and display hints related to the problem, helping you break down and solve it step by step. Why Use LeetCode Hint Helper? Improve Your Skills: Enhance your problem-solving abilities by understanding the thought process behind each hint. Save Time: Get unstuck quickly without having to search for help or peek at solutions. Boost Confidence: Gain the confidence to tackle more challenging problems with guided hints. LeetCode Hint Helper is designed to support your learning journey and make coding practice more effective and enjoyable. Whether you're preparing for coding interviews or sharpening your skills, this extension is your perfect companion.
A hardcoded JWT API key is embedded in the extension. Decoded, it contains the developer's personal email ([email protected]) and a one-year expiry. Every user of the extension shares this single credential when calling julep.ai, meaning the developer's account is publicly exposed and abusable by anyone who inspects the extension bundle. This is a credential hygiene issue rather than theft from users.
// Store your API key hereconst API_KEY = 'eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIwYmQ1M2ZlZC1jMmY3LTRkNDAtYjEyMC04YmUwZGNhYTkyZDEiLCJlbWFpbCI6InJ1c2hhYW4uY2hhd2xhQGdtYWlsLmNvbSIsImlhdCI6MTcxNzEzMDExMCwiZXhwaXJlc0luIjoiMXkiLCJyYXRlTGltaXRQZXJNaW51dGUiOjM1MDAsInF1b3RhUmVzZXQiOiIxaCIsImNsaWVudEVudmlyb25tZW50Ijoic2VydmVyIiwic2VydmVyRW52aXJvbm1lbnQiOiJwcm9kdWN0aW9uIiwidmVyc2lvbiI6InYwLjIiLCJleHAiOjE3NDg2ODc3MTB9.00eHvdV4xZSLaZL-VkGZnihYDeNbIIGxa0r8rS8_CSUJ6HmEBJByDLERcUbRrwxh20zq1jAWh29s5tYxBBFOcg';Text scraped from the active tab (via the extractText content script grabbing .elfjS innerText) is POSTed to a third-party AI service at api-alpha.julep.ai. While the intended use is LeetCode problem text, the content script has no URL check and will send any .elfjS element content from whatever active tab the user is on when the popup opens. This is low-risk data flow to an external endpoint but constitutes unauthorized data collection outside the user's immediate awareness.
async function getAgentId(problemdata) { const baseUrl = "https://api-alpha.julep.ai/api"; try { const responsed = await fetch(`${baseUrl}/sessions`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${API_KEY}` }, body: JSON.stringify({ "agent_id": "c576cc26-f111-482f-92ce-72994047e104", "situation": "You are Jessica. You are a coding genius. return the list in an array form", }), }); const data2 = await responsed.json(); const session_id = data2["id"]; const response_chat = await fetch(`${baseUrl}/sessions/${session_id}/chat`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${API_KEY}` }, body: JSON.stringify({ "messages": [{ "content": problemdata + " Give me 3 hints for this problem. Each hint should be a short sentence under 10 words. Provide just the list of hints separated by commas.", "role": "user" }] }), });Uses chrome.scripting.executeScript to inject a function into the active tab with no URL restriction. Under activeTab this is scoped to user-initiated invocations, but the injected extractText function runs on any site the user happens to be viewing when they click the extension icon, then forwards the scraped DOM text to a third-party API. Scope is narrow but the intent is not restricted to LeetCode domains.
document.addEventListener('DOMContentLoaded', () => { chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => { chrome.scripting.executeScript({ target: { tabId: tabs[0].id }, func: extractText }, (results) => {By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0 | 3 |
Files with findings
2 distinct paths — top paths by unique finding count:
- background.js2
- popup.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.