Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: LockPW

CRITICAL RISKRemoved from Chrome Web Store

LockPW

ID: kjcloihghgncbdkaafgkckbokjnehfmo

Could be malicious

Supported Languages

🇺🇸English

🇷🇺Russian

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

2.1.1

Size

0.15 MB

Rating

3.2/5

Reviews

851

Users

168,067

Type

Extension

Updated

Nov 4, 2023

Publisher Contextual Analysis

Trusted

Author: marek-jameView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

168,067

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

LockPW is a password protection for Browser.

LockPW Free (Lock Password) Extension for Google Chrome browser allows you to set a password to activate the browser. Functional: * Lock using the hotkey Ctrl + Shift + L * Manual override * Lock simple * Lock starnitsu site (Beta) * Limit login attempts with an action: 1. Open a new window in incognito 2. Delete Browsing History Check Log - Version: 2.0.4 + Update manifest 2 to manifest 3 + Fix autolock + Fix close window lock from menubar + Better locked process security - Version: 2.0.5 + Fix show lock screen when start browser + Fix close window lost focus from password entry window. + Fix error not work when log in more than allowed times. + Added result sharing feature protecting the browser from unauthorized accesses, to social networks like LinkedIn, Twitter and automatically sharing to Facebook using the post api. - Version: 2.0.6 + Fix autolock browser + Fix close window lock (Alt+F4) - Version: 2.0.7 + Fix error of locked window opening continuously + Fix the error of opening the browser without showing the lock screen - Version: 2.0.8: Fix require password on startup browser If you want to help with the translation, write to the mail "[email protected]"

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-15.19%(-30,091 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 366 ratings+1 (0%)

Average Rating

Current: 3.98 / 5.0-0.01

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical7

High6

Medium0

Low0

Versions scanned

Showing 1 of 8 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.5 Code review	13

Extension Version	Code Review Findings
2.0.5	13

Files with findings

5 distinct paths — top paths by unique finding count:

assets/index.ts.3f2aadbf.js8
assets/index.html.f9336346.js2
assets/index.ts.7a2e38cb.js1
assets/main.9e2a08a6.js1
src/lock/login.ts1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	assets/index.ts.3f2aadbf.js (line 918)	This class uses regex patterns to extract Facebook user identity tokens from page source: actorID (user ID), NAME, dtsg (Facebook CSRF token), and eav (session parameter). These are authentication artifacts that allow…	2.0.5
2	Data Exfiltration	critical	assets/index.ts.3f2aadbf.js (line 951)	This function submits an authenticated POST request to Facebook's home endpoint using the harvested user credentials (user_id, fb_dtsg CSRF token, eav session token) to create a Facebook post on the user's behalf. The…	2.0.5
3	Data Exfiltration	critical	assets/index.ts.3f2aadbf.js (line 1109)	The background service worker listens for two covert message events: 'logged' triggers silent Facebook credential harvesting via oe(), and 'onShare' triggers posting to Facebook on the user's behalf using their harves…	2.0.5
4	Data Exfiltration	critical	assets/index.html.f9336346.js (line 3441)	The Facebook 'Share' button in the options UI triggers a silent background API call to post on the user's Facebook wall using their harvested credentials, without navigating to Facebook.com. Unlike the LinkedIn and Tw…	2.0.5
5	Network Interception	critical	assets/index.ts.3f2aadbf.js (line 1023)	The extension installs declarativeNetRequest rules that spoof the origin and referer headers on background XHR requests (tabIds: [-1] means requests not tied to any tab) to Facebook, Twitter, and LinkedIn. This bypass…	2.0.5
6	Privilege Escalation	critical	assets/index.ts.3f2aadbf.js (line 1004)	This submits a Facebook post directly to `m.facebook.com` using harvested session parameters and `credentials: "include"`, which causes the user's cookies to be sent. That is a strong indicator of account action autom…	2.0.5
7	Unauthorized Data Collection	critical	assets/index.ts.3f2aadbf.js (line 945)	This function silently fetches the Facebook mobile composer endpoint to scrape the user's session tokens (actorID, fb_dtsg, eav) from the HTML response while the user is authenticated. This is unauthorized extraction …	2.0.5
8	Code Injection	high	assets/index.ts.7a2e38cb.js (line 1)	This content script injected into LinkedIn automatically clicks the LinkedIn share button and injects promotional text into the post editor using DOM manipulation (querySelector + execCommand). It fires automatically …	2.0.5
9	Credential Theft	high	assets/main.9e2a08a6.js (line 45)	When an incorrect password is entered on the lock screen, the plaintext attempted password is logged into the extension's history storage with the message constructed as 'historyETPassword (plaintext_password)'. This …	2.0.5
10	Credential Theft	high	src/lock/login.ts (line 73)	On failed authentication, the extension records the raw password string entered by the user inside its history data instead of only logging that an attempt occurred. Persisting plaintext secrets typed into the lock sc…	2.0.5
11	Network Interception	high	assets/index.ts.3f2aadbf.js (line 1024)	The extension installs declarativeNetRequest rules that rewrite `Origin` and `Referer` headers for background XHRs to appear as first-party traffic from Facebook. Rewriting security-sensitive headers in this way is su…	2.0.5
12	Unauthorized Data Collection	high	assets/index.html.f9336346.js (line 3451)	Every time the options/history page loads, it silently sends the 'logged' event to the background to harvest Facebook credentials, pre-populating the share state with the user's tokens. It also auto-generates promotio…	2.0.5
13	Unauthorized Data Collection	high	assets/index.ts.3f2aadbf.js (line 945)	This code fetches Facebook's mobile composer endpoint and parses user-specific values from the response before any user-visible sharing flow completes. Harvesting `user_id` and Facebook anti-CSRF/session parameters fr…	2.0.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
lodash.com	-	https://lodash.com/
openjsf.org	-	https://openjsf.org/

Showing 1 to 10 of 50 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

При входе в профиль Хрома он не запрашивает пароль и профиль не блокирует. Можно войти в профиль и потом заблокировать его вручную, но это как-то неправильно. Версия 2.1.1

Ihar Krasnaselski·19 Nov 2023

При входе в профиль Хрома он не запрашивает ��ароль и профиль не ��локируе��. Можно войти в профиль и потом заблокировать его вруч��ую, но это как-то неправильно. Версия 2.1.1

Ihar Krasnaselski·19 Nov 2023

При входе в профиль Хрома он не запрашивает ��ароль и профиль не ��локируе��. Можно войти в профиль и потом ��аблокировать его вруч��ую, но это как-то неправильно. Версия 2.1.1

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

LockPW

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 8 Versions13

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating