Security Alert: Confirmed Malware
This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: MeddleMonkey
CRITICAL RISKRemoved from Chrome Web Store
MeddleMonkey
ID: moihledlmchhofenpacbhphnbnpakgmo
Could be malicious
Extension Info & Metadata
Status
Removed
Version
1.0.7
Size
0.35 MB
Rating
3.8/5
Reviews
622
Users
4,359,448
Type
Extension
Updated
Dec 24, 2020
Category
22_accessibility
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
Publisher Contextual Analysis
- Author
- meddlemonkeyextView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Total Extensions
1
Active
0
Obsolete
1
Listed
1
Unlisted
0
Total Users
4,359,448
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Userscript support for Chromium based browsers like Opera and Chrome.
MeddleMonkey (fork Violentmonkey with some features) is the most popular user script manager, with over 4 million users, which supports for Chromium-based browsers like Opera and Chrome. Even though some of the supported browsers have built-in support for custom scripts, the MeddleMonkey browser extension will provide much more convenient management of these scripts. This extension supports features such as easy script installation, automatic update checks, a simple overview of the scripts running on the tab, and has a built-in editor. In addition, there is a good chance that incompatible scripts will work fine when using MeddleMonkey. MeddleMonkey Chrome extension greatly simplifies the process of managing custom scripts. The MeddleMonkey icon in the upper right corner shows the number of running scripts, and clicking on it opens a list of already running scripts and a list of scripts that can be run on this page. It only takes a minute to install the extension, so give it a try! Features: 1. Update automatically according to the metadata. 2. Scripts will be executed in order as shown in the list. 3. GM functions are supported. 4. Support import from and export to a zip file.
Extracted Data
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
By severity
Critical19
High32
Medium12
Low3
Versions scanned
Showing 4 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.7 | 19 |
| 1.0.6 | 26 |
| 1.0.5 | 14 |
| 1.0.3 | 7 |
Files with findings
7 distinct paths — top paths by unique finding count:
- background/app.js22
- injected.js19
- options/app.js14
- cache.js7
- mylib/CodeMirror/search.js2
- manifest.json1
- popup/app.js1
S.No. | Category | Severity | File | Summary | Found in Version |
|---|---|---|---|---|---|
| 1 | Code Injection | critical | injected.js (line 726) | The content script sends a message to the background page on every page load and dispatches the response as a command via `handleOnExtensionResponse`. The response object's key is normalized and looked up as a method … | |
| 2 | Code Injection | critical | injected.js (line 904) | The `inject` function writes arbitrary string code directly into a `<script>` element's `innerHTML` and appends it to every page visited. This technique injects JavaScript into the page's own execution context (bypass… | |
| 3 | Code Injection | critical | injected.js (line 661) | User scripts fetched from remote sources are compiled and executed using the `Function` constructor (equivalent to `eval`) on every page the content script runs on, with no integrity verification. The `Function.apply(… | |
| 4 | Code Injection | critical | options/app.js (line 593) | The `addScripts` function dynamically creates `<script>` elements and sets their `innerHTML` directly from a data object, allowing arbitrary JavaScript to be injected into the privileged options page. If any upstream … | |
| 5 | Code Injection | critical | injected.js (line 895) | The `inject` function sets `script.innerHTML` to an arbitrary code string and appends it to the live page DOM at `document_start` on every URL in every frame. This is a direct code injection into the page's main-world… | |
| 6 | Code Injection | critical | injected.js (line 765) | The `injectScript` function builds an executable script string by directly concatenating `data[1]` (wrapper key names) and `data[2]` (raw code string) without sanitization, then passes it to `inject()` which sets `scr… | |
| 7 | Code Injection | critical | options/app.js (line 593) | The `addScripts` function dynamically creates script elements with either an `innerHTML` property (executing arbitrary code strings directly) or a `src` property (loading external URLs). Setting `innerHTML` on a scrip… | |
| 8 | Data Exfiltration | critical | background/app.js (line 33) | The error reporter POSTs the extension's runtime ID, full manifest contents, and error data (which can include userscript names and metadata) to an attacker-controlled `reportUrl` supplied by the user script. The requ… | |
| 9 | Data Exfiltration | critical | background/app.js (line 205) | On startup, the extension enumerates every installed user script by name, joins them into a semicolon-delimited string, and passes this list as the `cd1` custom dimension to the Google Analytics `collect` endpoint. Th… | |
| 10 | Obfuscation | critical | background/app.js (line 15) | Character-code obfuscation is used to construct the string 'constructor' at runtime via `num2str(99,111,110,115,116,114,117,99,116,111,114)`, then stored in `k` and used as `Promise[k]` — resolving to `Promise['constr… | |
| 11 | Privilege Escalation | critical | background/app.js (line 246) | The `ErrorReport` message handler accepts a `reportUrl` from any content script or user script without any URL validation or allowlist check, then passes it directly to the `errorReport` function. Any user script — in… | |
| 12 | Remote Code Loading | critical | cache.js (line 38) | A hardcoded promotional block in the Script Library template bundles a download link for https://download.sf-helper.com/chrome/helper.user.js — an external userscript from the Savefrom.net domain appended with a cache… | |
| 13 | Remote Code Loading | critical | background/app.js (line 15) | The `createErrorReporter` function uses character-code obfuscation (`num2str(99,111,110,115,116,114,117,99,116,111,114)`) to reconstruct the string `'constructor'` at runtime, which is then used to access `Promise['co… | |
| 14 | Remote Code Loading | critical | options/app.js (line 294) | The extension fetches arbitrary remote URLs specified in userscript `@require` and `@resource` metadata directives without any URL validation or content integrity checking. Any userscript can declare remote JavaScript… | |
| 15 | Remote Code Loading | critical | background/app.js (line 33) | The error reporter sends a credentialed POST (`withCredentials: true`) to an attacker-controlled `reportUrl` containing the full extension manifest merged with error data, base64-encoded. The server response is then b… | |
| 16 | Remote Code Loading | critical | injected.js (line 403) | The `GM_errorReport` API exposed to user scripts accepts a `flags` array of character codes and reconstructs a URL string from them using `String.fromCharCode`. This character-code encoding is itself an obfuscation te… | |
| 17 | Remote Code Loading | critical | options/app.js (line 304) | When a user script is installed, the extension silently fetches all URLs declared in the script's `@require` and `@resource` metadata headers without user confirmation or URL validation. These fetched resources — whic… | |
| 18 | Tracking | critical | background/app.js (line 1380) | A persistent unique UUID is generated and stored in chrome.storage.local, then used as the client ID in a Google Analytics beacon sent to UA-142528268-15 every 12 hours. The payload includes the user's UI locale and t… | |
| 19 | Unauthorized Data Collection | critical | background/app.js (line 1368) | The `init` function in the analytics module (module 9) sends a POST to `https://www.google-analytics.com/collect` with a persistent per-device UUID (`cid`), the browser's UI locale, the extension version, and—critical… | |
| 20 | Code Injection | high | background/app.js (line 649) | The extension uses Function.apply(null, wrapperKeys.concat([code])) to dynamically construct and execute arbitrary code via the Function constructor — functionally equivalent to eval. The code variable contains usersc… | |
| 21 | Code Injection | high | injected.js (line 830) | The inject function sets script.innerHTML to an arbitrary code string and appends it to the DOM, executing it in the page's JavaScript context. This is the primary code injection vector used by the content script runn… | |
| 22 | Code Injection | high | cache.js (line 20) | An immediately-invoked XHR fetches /images/sprite.svg and injects the raw response directly into document.body via innerHTML. Assigning arbitrary XHR response text to innerHTML without sanitization creates a DOM-based… | |
| 23 | Code Injection | high | cache.js (line 39) | The Script Library detail template uses Vue's v-html directive to render stat.label, stat.value, and script.authorDescription from remotely fetched script metadata. v-html disables Vue's HTML escaping and directly set… | |
| 24 | Code Injection | high | injected.js (line 774) | The `injectScript` fallback path serializes arbitrary code — including full user script content — into a string and injects it into the page DOM via `inject()` when the normal `Function` constructor path is unavailabl… | |
| 25 | Code Injection | high | injected.js (line 652) | User script code strings are compiled into functions via the `Function` constructor (`Function.apply(null, wrapperKeys.concat([code]))`), which is equivalent to `eval`. The extension's manifest explicitly includes `'u… | |
| 26 | Code Injection | high | popup/app.js (line 44) | The popup accepts a `SetPopup` message from any content script running in the current tab, storing `data.menus` directly in the Vue store without validation. The `fixStyles` method then copies `bot.innerHTML` (built f… | |
| 27 | Code Injection | high | injected.js (line 819) | The `inject` function dynamically creates a `<script>` element, sets its `innerHTML` to arbitrary code, and appends it to the live DOM of every visited page (`<all_urls>`, `document_start`, `all_frames`). This is a cl… | |
| 28 | Code Injection | high | injected.js (line 198) | The communicator object is serialized with `objEncode` and injected into every page's DOM context via `initCommunicator`. It uses `(0, eval)('true')` — an indirect `eval` call in the global scope — to probe whether th… | |
| 29 | Data Exfiltration | high | injected.js (line 403) | The `GM_errorReport` function accepts a `flags` array of character codes decoded into a URL and forwarded to the background page as a `reportUrl`. This API is injected into every user script without restriction, allow… | |
| 30 | Network Interception | high | background/app.js (line 1047) | A blocking webRequest.onBeforeSendHeaders listener is registered on all URLs for all XMLHttpRequests, giving the extension the ability to read and modify outgoing request headers including Authorization, Cookie, and O… | |
| 31 | Network Interception | high | background/app.js (line 1141) | This `webRequest.onBeforeSendHeaders` listener intercepts every XMLHttpRequest across all URLs and strips internal `VM-*` headers, while also injecting spoofed sensitive headers (`User-Agent`, `Referer`, `Origin`, `Ho… | |
| 32 | Network Interception | high | background/app.js (line 1206) | This listener uses `redirectUrl: 'javascript:history.back()'` as a redirect target — a `javascript:` URL executed in the context of the navigated page, which can lead to script execution in older Chrome versions. It a… | |
| 33 | Network Interception | high | injected.js (line 318) | The `GM_xmlhttpRequest` implementation proxies HTTP requests through the extension's background page, which has `<all_urls>` permission and bypasses same-origin policy. The `details` object passed by user scripts incl… | |
| 34 | Network Interception | high | background/app.js (line 1135) | The extension installs a blocking `webRequest.onBeforeSendHeaders` listener on all URLs for all XHR requests, intercepting and modifying headers before they are sent. It strips internal `VM-*` headers from user script… | |
| 35 | Network Interception | high | background/app.js (line 1035) | The extension intercepts and mutates outgoing request headers for every `XMLHttpRequest` across all URLs (`<all_urls>`) using `webRequestBlocking`. It strips any `VM-*` headers (preventing them from reaching the serve… | |
| 36 | Obfuscation | high | background/app.js (line 18) | The string `'constructor'` is reconstructed at runtime using `String.fromCharCode(99,111,110,115,116,114,117,99,116,111,114)` and stored in variable `k`, concealing the use of `Promise['constructor']` (i.e., the `Func… | |
| 37 | Privilege Escalation | high | background/app.js (line 114) | On every extension startup, `injectOnRun` programmatically injects `injected.js` into every currently active tab via `chrome.tabs.executeScript`, with no URL filtering beyond excluding `chrome://` pages. This means th… | |
| 38 | Privilege Escalation | high | injected.js (line 96) | The wrapper object explicitly exposes `eval` (line 97) and wraps `fetch`, `postMessage`, `atob`, `btoa`, and other sensitive browser APIs for use by installed user scripts. This grants every installed user script dire… | |
| 39 | Remote Code Loading | high | injected.js (line 706) | The injectScript function constructs a script string by concatenating JSON-encoded data with raw code (data[2]) received from the background page via CustomEvent, then injects it into the page DOM via script.innerHTML… | |
| 40 | Remote Code Loading | high | options/app.js (line 356) | The getFile method fetches arbitrary URLs for userscript @require dependencies and @resource metadata specified in scripts fetched from external sources like greasyfork.org. The fetched content is persisted into exten… | |
| 41 | Remote Code Loading | high | options/app.js (line 1629) | The install URL for a userscript is extracted directly from an HTML attribute of a remotely fetched greasyfork.org page and concatenated with the host origin without validation. A malicious or compromised greasyfork.o… | |
| 42 | Remote Code Loading | high | options/app.js (line 593) | The addScripts function dynamically creates and injects script elements with either an arbitrary src URL or direct innerHTML (inline code), then appends them to the document body. This is a runtime dynamic code inject… | |
| 43 | Remote Code Loading | high | options/app.js (line 1421) | The `installScript` function fetches a detail page from an external URL (greasyfork.org) and navigates the options page to `info.installURL` derived from that external HTML. The install URL is extracted from a remotel… | |
| 44 | Remote Code Loading | high | options/app.js (line 356) | The `getFile` method issues an unconstrained XHR GET to any URL passed as its argument, with no allowlist or domain validation. Because the extension has `<all_urls>` permission, these requests bypass same-origin rest… | |
| 45 | Remote Code Loading | high | background/app.js (line 1100) | The `onBeforeRequest` blocking listener intercepts any main-frame navigation to a `.user.js` URL and immediately fetches its raw content via a synchronous `XMLHttpRequest` (`x.open('GET', ..., false)`). The full scrip… | |
| 46 | Tracking | high | background/app.js (line 1357) | The extension silently generates and persistently stores a UUID in chrome.storage.local that is used to uniquely identify the user across repeated analytics beacon calls every 12 hours. This UUID acts as a fingerprint… | |
| 47 | Tracking | high | background/app.js (line 1474) | On every browser startup the extension generates and persists a unique UUID (`cid`) per-device and sends it along with all installed userscript names (`cd1`), the browser UI locale, and the extension version to a hard… | |
| 48 | Tracking | high | background/app.js (line 1468) | On every install and startup, the extension sends a Google Analytics hit (tracking ID UA-142528268-15) containing a persistent per-device UUID, the user's UI locale, the extension version, and `cd1` — populated with t… | |
| 49 | Unauthorized Data Collection | high | background/app.js (line 210) | On every startup, the extension enumerates all installed userscript names, concatenates them with semicolons, and passes that list to statUtils.init(scriptNames) which transmits it as the cd1 custom dimension to Googl… | |
| 50 | Unauthorized Data Collection | high | injected.js (line 397) | `unsafeWindow` — a direct reference to the real `window` object of the page — is force-injected into every user script's grant list regardless of whether the script requested it. This gives every user script unrestric… | |
| 51 | Unauthorized Data Collection | high | options/app.js (line 356) | The `getFile` method fetches arbitrary URLs passed from userscript `@require` and `@resource` headers using `XMLHttpRequest`. With the extension's `<all_urls>` permission, these fetches can reach any internal network … | |
| 52 | Code Injection | medium | injected.js (line 199) | The content script uses the indirect eval pattern (0, eval)('true') to probe whether the page's CSP allows eval execution. This indirect eval runs in global scope to determine which code injection path to use. Since t… | |
| 53 | Code Injection | medium | options/app.js (line 1537) | Raw HTML from greasyfork.org XHR responses is parsed by direct string concatenation into DOMParser.parseFromString without sanitization. While parsed into a detached document, extracted values like script stats HTML a… | |
| 54 | Code Injection | medium | cache.js (line 47) | The Installed Scripts panel template renders a message variable using v-html, bypassing Vue's XSS protections. If message is ever sourced from user-controlled input, remote script metadata, or extension communication … | |
| 55 | Code Injection | medium | injected.js (line 207) | The extension tests whether `eval` is available in the page context by calling it indirectly via `(0, eval)('true')` at `document_start` on every page. This is used to detect Content Security Policy restrictions and s… | |
| 56 | Code Injection | medium | cache.js (line 20) | An immediately-invoked XHR fetches `/images/sprite.svg` and injects the response directly into `document.body` via `innerHTML` without sanitization. The XHR is executed in the context of whichever page the content scr… | |
| 57 | Code Injection | medium | cache.js (line 20) | Raw SVG response text is assigned directly to `div.innerHTML` without sanitization and injected into the DOM. While the source is a local extension resource, this `innerHTML` assignment pattern is inherently unsafe — … | |
| 58 | Code Injection | medium | manifest.json (line 1) | The extension's own Content Security Policy explicitly permits `unsafe-eval`, which allows dynamic code evaluation (`eval`, `Function()`, `setTimeout(string)`) inside the extension's background page and popups. This w… | |
| 59 | Network Interception | medium | background/app.js (line 1112) | A blocking webRequest.onBeforeRequest listener intercepts all main-frame navigations, and when a .user.js URL is detected, makes a synchronous XMLHttpRequest to fetch and cache the script before the browser processes … | |
| 60 | Remote Code Loading | medium | options/app.js (line 1507) | The extension makes outbound XMLHttpRequest calls to greasyfork.org to fetch and parse script listings and detail pages, then extracts install URLs from the parsed HTML response. A MITM or compromised greasyfork.org r… | |
| 61 | Remote Code Loading | medium | cache.js (line 38) | The script library UI template hardcodes a promotional entry for 'Savefrom.net Helper' that links directly to `https://download.sf-helper.com/chrome/helper.user.js` with a cache-busting timestamp. This causes the exte… | |
| 62 | Tracking | medium | injected.js (line 925) | On every page load, `initCommunicator` serializes the entire `comm` object into a string and injects it into the page's JavaScript context. The current page URL (`location.href`) is also sent to the background via `Ge… | |
| 63 | Tracking | medium | options/app.js (line 1507) | The extension sends the user's browser locale (`navigator.language`) as part of the URL path to `https://greasyfork.org` when browsing scripts. While greasyfork.org is a legitimate site, this sends a fingerprinting si… | |
| 64 | Code Injection | low | mylib/CodeMirror/search.js (line 45) | The dialog HTML is constructed by concatenating strings from chrome.i18n.getMessage() and then assigned directly to dialog.innerHTML. While chrome.i18n messages normally originate from the extension's own _locales fil… | |
| 65 | Code Injection | low | options/app.js (line 613) | The `addCSS` function sets `innerHTML` on a `<style>` element from a data object's `html` property. Malicious CSS can be used for UI redressing, keylogging via attribute selectors, and exfiltrating data. The same data… | |
| 66 | Code Injection | low | mylib/CodeMirror/search.js (line 45) | The search dialog is constructed by concatenating `chrome.i18n.getMessage` return values into an HTML string and assigning it to `dialog.innerHTML`. If any i18n message contains malicious HTML (e.g., due to a tampered… |
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
18
IPv4
1
IPv6
0
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
| wiki.greasespot.net | /@grant | http://wiki.greasespot.net/@grant |
| www.google-analytics.com | /collect | https://www.google-analytics.com/collect |
| download.sf-helper.com | /chrome/helper.user.js | https://download.sf-helper.com/chrome/helper.user.js?ts= |
| www.w3.org | /2000/svg | http://www.w3.org/2000/svg |
| www.w3.org | /1999/xlink | http://www.w3.org/1999/xlink |
| www.webtoolkit.info | /javascript-utf8.html | http://www.webtoolkit.info/javascript-utf8.html |
| developer.mozilla.org | /docs/Web/JavaScript/Reference/Global_Objects | http://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects |
| developer.mozilla.org | /docs/Web/API/Window | http://developer.mozilla.org/docs/Web/API/Window |
| wiki.greasespot.net | /Greasemonkey_Manual:API | http://wiki.greasespot.net/Greasemonkey_Manual:API |
| codemirror.net | /LICENSE | http://codemirror.net/LICENSE |
Showing 1 to 10 of 20 rows
Rows per page:
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
| 18.18.196.46 | IPv4 | - |
Version History
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.