Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: LocalStorage Manager

CRITICAL RISKRemoved from Chrome Web Store

LocalStorage Manager

ID: fkhoimdhngkiicbjobkinobjkoefhkap

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

2.6

Size

0.04 MB

Rating

3.9/5

Reviews

Users

27,093

Type

Extension

Updated

Jan 2, 2023

Publisher Contextual Analysis

Trusted

Author: michailchaban198812View Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

27,093

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Add, edit, remove, export and import local storage and session storage data

Source code and bug tracker are available at https://github.com/gabrielbarros/localstorage-manager ——————————————————— Add, edit, remove, export and import local storage and session storage data. ---------------------------------------- According to Wikipedia, web storage offers two different storage areas — local storage and session storage — which differ in scope and lifetime. Data placed in local storage is per origin (the combination of protocol, hostname, and port number as defined in the same-origin policy) (the data is available to all scripts loaded from pages from the same origin that previously stored the data) and persists after the browser is closed. Session storage is per-origin-per-window-or-tab and is limited to the lifetime of the window. Session storage is intended to allow separate instances of the same web application to run in different windows without interfering with each other, a use case that's not well supported by cookies.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+9.38%(+2,324 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 36 ratings

Average Rating

Current: 4.11 / 5.0-0.02

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High3

Medium0

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.6 Code review	5

Extension Version	Code Review Findings
2.6	5

Files with findings

2 distinct paths — top paths by unique finding count:

content.js4
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	content.js (line 42)	Hard-codes a covert command-and-control endpoint ('data-statystic.net' — a misspelling of 'statistic' typical of typo-squatted tracking infrastructure, unrelated to the extension publisher) and invokes it on every pag…	2.6
2	Remote Code Loading	critical	content.js (line 1)	The content script (injected at document_start on every https:/// page) periodically fetches a payload from a hard-coded third-party server (data-statystic.net) with credentials:'include', persists the response in c…	2.6
3	Code Injection	high	content.js (line 3)	Constructs a <script> element pointing at chrome.runtime.getURL('bundle.js') (exposed via web_accessible_resources "*.js" matching every origin) and stamps the remotely fetched payload onto a 'data-options' attribute …	2.6
4	Privilege Escalation	high	manifest.json (line 17)	Manifest grants the malicious content.js execution at document_start on every HTTPS site and exposes ALL extension JS files as web-accessible to every origin. Neither configuration is needed for a localStorage manager…	2.6
5	Tracking	high	content.js (line 19)	Calls fetch() to data-statystic.net with credentials:'include', which transmits any cookies the browser holds for that domain (a persistent tracking/identifier cookie set by the C2). Combined with execution at documen…	2.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


stackoverflow.com	/a/7220510	https://stackoverflow.com/a/7220510
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	https:///
data-statystic.net	/api/v3/	https://data-statystic.net/api/v3/?id=lstorage

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Constantly trying to send request somewhere I had already blocked in etc/host.

Google Security (Administrator)·5 Feb 2023

Potentially compromised app. After latest update it tries to collect my sites data, and creates requests to strange site: https://data-statystic.net/api/v3/?id=lstorage After googling found post on reddit https://www.reddit.com/r/chrome/comments/z7v9jr/potentially_compromised_extensions_floating/

Sergey Bordychevskiy·5 Jan 2023

It's quite a handy useful tool

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

LocalStorage Manager

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating