Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Netflix Extension

CRITICAL RISKRemoved from Chrome Web Store

Netflix Extension

ID: jncmndnhflngekilembpbdfnokagflcg

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.1

Size

0.49 MB

Rating

2.6/5

Reviews

Users

94,786

Type

Extension

Updated

Jun 21, 2020

Publisher Contextual Analysis

Author: http://netflixextension.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

94,786

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Open Netflix in a browser extension through an easily accessible button

Netflix Extension provides users with a button that directs them to their favorite shows and movies. Clicking the extension’s icon in the browser bar will show a small window for the button. Netflix Extension also updates the default search engine to point on our search engine. If you wish to rollback, just go in chrome settings to restore your favorite search engine. For more information visit www.netflixextension.com. As of June 19 2020, Version 2.1 of Netflix Extension is available. Privacy: netflixextension.com/privacy.html Terms: netflixextension.com/terms.html Disclaimer: NETFLIX is a trademark of Netflix, Inc.. This application and its developer(s) are in no way affiliated with Netflix, Inc..

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High2

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.1 Code review	5

Extension Version	Code Review Findings
2.1	5

Files with findings

2 distinct paths — top paths by unique finding count:

background.js3
manifest.json2

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 2299)	Every tab update triggers a POST to `https://www.graphapis.com/api/v1/cmps` with the user's current tab URL and page title base64-encoded. This constitutes covert exfiltration of the user's full browsing history to a …	2.1
2	Remote Code Loading	critical	background.js (line 2369)	The `/cmps` server response returns a queue of 'campaign' action objects; the extension executes them to open new windows, create new tabs, or forcibly redirect the user's active tab to attacker-controlled URLs. This …	2.1
3	Tracking	high	manifest.json (line 32)	The extension silently replaces the user's default search engine with a redirect through `netflixextension.com/s.php`, giving the publisher visibility into and monetisation of every search query. This also appears in …	2.1
4	Unauthorized Data Collection	high	background.js (line 2223)	On installation, the extension beacons OS, architecture, platform, and a hardcoded internal UUID to `https://www.graphapis.com/api/v1/install`. This registers the device with a remote tracking infrastructure. The resp…	2.1
5	Code Injection	medium	manifest.json (line 30)	`unsafe-eval` in the extension's CSP allows dynamic code evaluation via `eval()` or `Function()`, weakening the extension sandbox and enabling runtime code injection if any attacker-controlled string reaches an eval c…	2.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.graphapis.com	-	https://www.graphapis.com
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
api.bing.com	/*	https://api.bing.com/*
www.netflixextension.com	/s.php	https://www.netflixextension.com/s.php?q={searchTerms}
www.netflixextension.com	/favicon.ico	https://www.netflixextension.com/favicon.ico
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
lodash.com	-	https://lodash.com/
openjsf.org	-	https://openjsf.org/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

It is super helpful

evan salzsieder·14 Sept 2020

i hate u

a aster·23 Aug 2020

Doesnt work

prasenjit chaudhuri·17 Aug 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Netflix Extension

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews