Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: My cursor

CRITICAL RISKRemoved from Chrome Web Store

My cursor

ID: ebdadpngckipngnafhinjbcjebjgfgjm

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.1.9

Size

1.99 MB

Rating

3.4/5

Reviews

Users

897,739

Type

Extension

Updated

Nov 1, 2020

Publisher Contextual Analysis

Author: Jamie NoelView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

897,739

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Change cursor - select from huge cursor collection or upload your custom cursor

My cursor changes mouse cursor on web pages. We manually selected a huge preset of beautiful cursors! - 100+ cursors in various categories (See screenshot!) - Upload a custom cursor PS. It doesn’t work over browser toolbar or on settings pages.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High3

Medium1

Low2

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.8 Code review	3
1.1.7 Code review	5

Extension Version	Code Review Findings
1.1.8	3
1.1.7	5

Files with findings

3 distinct paths — top paths by unique finding count:

background.js6
popup.html1
settings.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 216)	Still within the origin-unvalidated `onMessageExternal` listener, `get_config` dumps the entire `chrome.storage.local` contents (including any user-uploaded cursor images stored as base64 data URIs) to any requesting …	1.1.7
2	Remote Code Loading	critical	background.js (line 7)	The background page dynamically injects and executes a remote script from Google Tag Manager at runtime. Remote script loading gives the extension author server-side control over code that runs with extension privileg…	1.1.8
3	Privilege Escalation	high	background.js (line 180)	The extension accepts external messages and performs privileged state changes without validating `sender.id` or any allowlist. Another extension or app can push arbitrary collection data into storage, altering what th…	1.1.8
4	Unauthorized Data Collection	high	background.js (line 240)	This external message handler exposes full read and write access to the extension's local and sync storage with no authentication or sender checks. That creates an information disclosure path and lets outside extensio…	1.1.8
5	Unauthorized Data Collection	high	background.js (line 163)	The extension registers a `chrome.runtime.onMessageExternal` listener with no validation of the sender's origin or extension ID. Any website can call this listener and invoke `getInstalled` (leaks extension version an…	1.1.7
6	Other	medium	background.js (line 238)	The `authSync` method runs every 10 seconds and unconditionally overwrites `chrome.storage.local.collection` with the hardcoded `listOfCollection` and writes a `packs` array to sync storage. This persistent polling lo…	1.1.7
7	Tracking	low	popup.html (line 6)	The popup page loads a font directly from an external Google Fonts CDN URL. Every time the popup is opened, the user's IP address, browser fingerprint, and timing data are transmitted to Google's servers without user …	1.1.7
8	Tracking	low	settings.html (line 6)	The settings/options page makes two separate external HTTP requests to Google Fonts on every open, leaking the user's IP and browser metadata to a third party. Bundling fonts locally is trivial; loading them externall…	1.1.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.googletagmanager.com	/gtm.js	https://www.googletagmanager.com/gtm.js?id=GTM-T79D9DF&l=
www.opensource.org	/licenses/mit-license.php	http://www.opensource.org/licenses/mit-license.php
appelsiini.net	/projects/lazyload	https://appelsiini.net/projects/lazyload
github.com	/twbs/bootstrap/blob/master/LICENSE	https://github.com/twbs/bootstrap/blob/master/LICENSE
goo.gl	/pxwQGp	https://goo.gl/pxwQGp
popper.js.org	-	https://popper.js.org
github.com	/twbs/bootstrap/issues/24251	https://github.com/twbs/bootstrap/issues/24251
www.quirksmode.org	/blog/archives/2014/02/mouse_event_bub.html	https://www.quirksmode.org/blog/archives/2014/02/mouse_event_bub.html
jquery.com	-	http://jquery.com/
sizzlejs.com	-	http://sizzlejs.com/

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Uhhh i think it's pretty cool but idk how to make it always work on any tab/website. So please help me.

Maze·13 Jan 2021

i have found out how to remove the annoying cursor 1. remove it from chrome 2. power off computer 3. turn computer back on and now it is gone! p.s. i am sorry if it didn't work for you. i just wrote this bc i worked for me!

zoey petersen·12 Jan 2021

ALL the curser ones didn't work I hope this one works.

Anya

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

My cursor

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews