Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Moonrise Dark Theme

CRITICAL RISKRemoved from Chrome Web Store

Moonrise Dark Theme

ID: clpbaehoboiidoadkaphpeglnpcgkjaj

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.20

Size

0.55 MB

Rating

3.1/5

Reviews

Users

2,515,940

Type

Extension

Updated

Sep 22, 2020

Publisher Contextual Analysis

Author: Angela StineView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

2,515,940

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Neat dark themes for the most popular websites

Moonrise Dark Theme applies dark themes for the most popular websites. All dark themes are well tested and maintained. Features: ✨ Dark themes for the most popular websites. Supports 50+ websites ✨ If something doesn’t work you can add a site to the blacklist. ✨ Night mode: applies yellow color to all the sites. Keeps your eyes relaxed

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High3

Medium4

Low1

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.20 Code review	6
2.19 Code review	4

Extension Version	Code Review Findings
2.20	6
2.19	4

Files with findings

5 distinct paths — top paths by unique finding count:

manifest.json4
background.js2
inject.js2
css/gmail.css1
css/twitch.css1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	background.js (line 63)	The background script injects a Google Tag Manager container (GTM-TTDQPHT) by dynamically replacing a DOM element with an externally-sourced script tag pointing to googletagmanager.com. GTM allows the extension operat…	2.20
2	Remote Code Loading	critical	manifest.json (line 34)	The extension's CSP deliberately whitelists google-analytics.com, googletagmanager.com, and all googleapis.com subdomains as permitted external script sources. For a dark theme extension there is no legitimate reason …	2.20
3	Privilege Escalation	high	background.js (line 10)	On installation, the extension immediately queries all open tabs (with an empty, unfiltered `chrome.tabs.query({})` call) and programmatically executes inject.js into every eligible tab. This means the content script …	2.20
4	Tracking	high	css/gmail.css (line 1919)	The CSS `content` property forces the browser to make an outbound HTTP request to `dark-by-dm9.webnode.it` every time a user opens Gmail. The selector `.gb_ae img.gb_ma` targets the Gmail profile picture element, ensu…	2.19
5	Unauthorized Data Collection	high	manifest.json (line 12)	The date/time library moment.js is declared as a content script injected into every page at document_start. A dark theme extension has no legitimate need for a date manipulation library in a content script context — C…	2.20
6	Other	medium	inject.js (line 112)	The variable `blacklist` is assigned without a var/let/const declaration inside a chrome.storage callback, creating an implicit global variable on every page's window object. Running at document_start on all URLs, thi…	2.20
7	Other	medium	manifest.json (line 11)	The 4,600-line `moment.js` date library is configured as a content script injected into every page (`<all_urls>`) at `document_start`, but no other extension file (`inject.js`, `background.js`, `popup.js`) ever refere…	2.19
8	Tracking	medium	css/twitch.css (line 241)	CSS background images are loaded from a third-party HTTP (not HTTPS) domain `file1.npage.de` on every Twitch page load. These external requests expose user IP addresses, timestamps, and browser fingerprints to the ope…	2.19
9	Unauthorized Data Collection	medium	inject.js (line 183)	The full URL of every visited page is captured via document.location.href at document_start and stored in the module-level variable tabUrl, running across all URLs including about:blank frames. While this snippet only…	2.20
10	Privilege Escalation	low	manifest.json (line 17)	`inject.js` runs inside all frames including `about:blank` frames (`match_about_blank: true`) at `document_start` on every URL. A dark-theme extension has no legitimate need to inject into dynamically-created blank fr…	2.19

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

156

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


chrome.google.com	-	https://chrome.google.com
www.googletagmanager.com	/gtm.js	https://www.googletagmanager.com/gtm.js?id=GTM-TTDQPHT&l=dl
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/master/LICENSE	https://github.com/twbs/bootstrap/blob/master/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
github.com	/mzalive/SVG	http://github.com/mzalive/SVG
github.com	/liorgrossman/darkness/tree/master/chrome-extension/themes	https://github.com/liorgrossman/darkness/tree/master/chrome-extension/themes
userstyles.org	/styles/126925/bing-dark	https://userstyles.org/styles/126925/bing-dark
colincon.ga	-	http://colincon.ga
userstyles.org	/styles/101431/new-duckduckgo-dark-theme	https://userstyles.org/styles/101431/new-duckduckgo-dark-theme

Showing 1 to 10 of 160 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-
4.4.3.2	IPv4	-

3.1 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

It doesn't work..

Maurício Bittencourt Pimenta·28 Jan 2021

really good, but need to add option to insert a new website still in white mode

Maruwan Almabrouk·26 Jan 2021

I love it thanks

Yoni Tube·5 Jan 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Moonrise Dark Theme

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews