Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Morphis Wallet

CRITICAL RISKRemoved from Chrome Web Store

Morphis Wallet

ID: heefohaffomkkkphnlpohglngmbcclhi

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

0.0.9.4

Size

0.90 MB

Rating

5.0/5

Reviews

2,470

Users

10,000

Type

Extension

Updated

Jul 7, 2023

Publisher Contextual Analysis

Author: morphiswalletView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Morphis - the most friendly wallet on Sui

Morphis wallet is a friendly wallet to get started with your web3 journey. Morphis allows you to manage all your web3 assets in one place, from tokens and NFTs to game assets and your gateway to thousands of dApps. Morphis will be your single access point to the unlimited potential of the web3 world.

User Growth

Showing data from Dec 13, 2022 to Dec 12, 2023

Versions

No change in user count

Compared to 3 months ago

28 versions released in this period

Rating Count

Total: 2,472 ratings

Average Rating

Current: 4.98 / 5.0-0.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High0

Medium1

Low2

Versions scanned

Showing 1 of 28 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.4.0 Code review	3

Extension Version	Code Review Findings
0.0.4.0	3

Files with findings

2 distinct paths — top paths by unique finding count:

manifest.json2
content-script.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	medium	manifest.json (line 19)	The published production extension grants itself host permission to a local service at http://127.0.0.1:5001/. A production crypto wallet should never carry localhost host permissions; the only consumers of such a per…	0.0.4.0
2	Other	low	manifest.json (line 19)	The wallet only declares host access to Sui devnet and staging fullnodes — there is no mainnet RPC permission. Combined with the version string (0.0.4.0), the obsolete status, and ~10k installs, this looks like a deve…	0.0.4.0
3	Other	low	content-script.js (line 2127)	The content script (matched against <all_urls> at document_start) injects dapp-interface.js into every page and bridges window.postMessage traffic to the background service worker via the 'morphis_content<->background…	0.0.4.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


github.com	/MikeMcl/decimal.js	https://github.com/MikeMcl/decimal.js
feross.org	-	https://feross.org
feross.org	/opensource	https://feross.org/opensource
127.0.0.1	-	http://127.0.0.1:9000
127.0.0.1	/gas	http://127.0.0.1:9123/gas
fullnode.devnet.sui.io	-	https://fullnode.devnet.sui.io:443/
faucet.devnet.sui.io	/gas	https://faucet.devnet.sui.io/gas
fullnode.testnet.sui.io	-	https://fullnode.testnet.sui.io:443/
faucet.testnet.sui.io	/gas	https://faucet.testnet.sui.io/gas
fullnode.mainnet.sui.io	-	https://fullnode.mainnet.sui.io:443/

Showing 1 to 10 of 80 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-
0.0.9.4	IPv4	-
106.136.211.212	IPv4	-
106.136.21.212	IPv4	-
194.146.39.233	IPv4	-
114.15.173.225	IPv4	-
112.133.171.199	IPv4	-
137.118.205.177	IPv4	-
194.145.39.232	IPv4	-
112.132.171.198	IPv4	-
137.117.205.176	IPv4	-
1.9.5.7	IPv4	-
1.5.1.4	IPv4	-

Showing 1 to 13 of 20 rows

Rows per page:

4.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

The SHIBA team is launching an official airdrop to celebrate the creation of our beloved token! Everyone can try their luck and get up to 180,000,000 tokens right now: https://windrop.me/

SHIBA Official Team·4 Jun 2023

Excellent

Prashant Tonge·11 May 2023

Chrome uzantılarını Microsoft Edge'ye aktardığınızda gizli kelimeler yerine sadece şifre istiyor.

Selim Tüylü·24 Mar 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Morphis Wallet

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 28 Versions3

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating