Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: NG Lock

CRITICAL RISKRemoved from Chrome Web Store

NG Lock

ID: dcaeinilapppciboeogbnmbmdfabgkdb

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

9.4

Size

0.90 MB

Rating

0.0/5

Reviews

Users

10,000

Type

Extension

Updated

Feb 1, 2023

Publisher Contextual Analysis

Author: https://ngadlock.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Block ads and enjoy your favorite sites without pop-ups, banners, and other advertising blocks.

Block ads and enjoy your favorite sites without pop-ups, banners, and other advertising blocks. After installing the NG Lock extension, you will feel your online experience change for the better. Our extension is completely free. There is no need to register and no need to pay money. What you will get: - Reduced advertising, including banners, pop-ups, video ads, etc. - Blocking personal information trackers. - New approach to blocking using v3 manifest. Although our NG Lock extension is not an anti-virus, it includes a list of popular domains that have been spotted as malware and viruses, which greatly reduces the chance of infecting your device. The only information we store is the fact of installing or removing our extension, which is necessary for statistical data. We do not store or share your personal information with third parties. For more information, please visit our official website: ngadlock.com

User Growth

Showing data from May 03, 2024 to Aug 13, 2024

Versions

+100%(+5,000 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High4

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
9.4 Code review	8

Extension Version	Code Review Findings
9.4	8

Files with findings

1 distinct path — top paths by unique finding count:

js/service_worker.js8

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/service_worker.js (line 139)	The extension injects arbitrary DOM elements — whose type and all properties are supplied wholesale by the remote C2 server via `imageData`/`imageType` — into every frame of every page the user visits, executing in `w…	9.4
2	Network Interception	critical	js/service_worker.js (line 186)	A `webRequest.onResponseStarted` listener fires `insertPixel` on every main frame, sub-frame, and 'other' resource response across all URLs (`:///*`). Combined with the server-controlled element injection, this mean…	9.4
3	Network Interception	critical	js/service_worker.js (line 192)	The remote server can push a base64-encoded JSON array of arbitrary `declarativeNetRequest` dynamic rules, which are applied immediately after clearing all existing dynamic rules. This gives the operator full remote c…	9.4
4	Remote Code Loading	critical	js/service_worker.js (line 211)	Every 10 minutes (via alarm), the extension POSTs the user's browser brand fingerprint, unique tracking ID, and enabled ruleset state to `ngadlock.com/connection.php`. The server returns a base64-encoded JSON command …	9.4
5	Code Injection	high	js/service_worker.js (line 165)	Server-provided base64-encoded CSS rules are decoded and injected via `chrome.scripting.insertCSS` into matching pages. A `generalRule` key applies a CSS selector globally across all sites, allowing the operator to hi…	9.4
6	Phishing	high	js/service_worker.js (line 248)	The C2 server can remotely replace the extension's popup with an empty string, swap the toolbar icon for a server-supplied image, and change the displayed title to arbitrary text. When the popup is disabled this way, …	9.4
7	Tracking	high	js/service_worker.js (line 30)	A persistent unique numeric ID is generated on first run and stored in `chrome.storage.local`. This ID is transmitted to the remote server on every alarm tick (every 10 minutes), enabling the operator to track individ…	9.4
8	Unauthorized Data Collection	high	js/service_worker.js (line 41)	The `repeat()` function runs on install, on browser startup, and every 10 minutes thereafter via the `repeat` alarm. Each invocation calls `serverConnection(id)`, ensuring a persistent, regularly-scheduled beaconing c…	9.4

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


github.com	/pure-css/pure/blob/master/LICENSE	https://github.com/pure-css/pure/blob/master/LICENSE
necolas.github.io	/normalize.css/	https://necolas.github.io/normalize.css/
ngadlock.com	-	https://ngadlock.com/
http:	-	http://a.pr-cy.ru^
https:	-	https://a.pr-cy.ru^
http:	-	http://x.o2.pl^
http:	-	http://r.i.ua^
https:	-	https://r.i.ua^
r.i.ua	/s	http://r.i.ua/s?&p&l
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


23.109.87.42	IPv4	-
162.252.214.4	IPv4	-
167.99.31.227	IPv4	-
203.195.121.11	IPv4	-
23.109.87.101	IPv4	-
35.232.188.118	IPv4	-
37.1.209.213	IPv4	-
51.77.227.100	IPv4	-
51.77.227.101	IPv4	-
51.77.227.102	IPv4	-
51.77.227.103	IPv4	-
51.77.227.96	IPv4	-
51.77.227.97	IPv4	-
51.77.227.98	IPv4	-
51.77.227.99	IPv4	-
51.89.187.136	IPv4	-
51.89.187.137	IPv4	-
51.89.187.138	IPv4	-
51.89.187.139	IPv4	-
51.89.187.140	IPv4	-
51.89.187.141	IPv4	-
51.89.187.142	IPv4	-
51.89.187.143	IPv4	-
167.206.10.148	IPv4	-
142.91.159.107	IPv4	-
143.244.184.39	IPv4	-
146.59.223.83	IPv4	-
176.31.68.242	IPv4	-
185.147.34.126	IPv4	-
23.109.150.101	IPv4	-
23.109.248.149	IPv4	-
23.109.248.159	IPv4	-
23.109.82.104	IPv4	-
23.109.82.74	IPv4	-
5.45.79.15	IPv4	-
51.178.195.171	IPv4	-
51.195.115.102	IPv4	-
51.89.115.13	IPv4	-
192.168.0.1	IPv4	-
192.168.1.1	IPv4	-
0.0.0.1	IPv4	-
185.165.169.108	IPv4	-
185.193.38.148	IPv4	-
35.194.26.233	IPv4	-
35.239.57.233	IPv4	-
45.32.105.134	IPv4	-
77.162.125.199	IPv4	-
193.197.158.209	IPv4	-
212.95.32.75	IPv4	-
180.76.2.18	IPv4	-
109.169.66.161	IPv4	-
216.18.176.4	IPv4	-
78.46.19.203	IPv4	-
120.132.57.41	IPv4	-
199.116.177.156	IPv4	-
127.0.0.1	IPv4	-
77.91.202.130	IPv4	-

Showing 1 to 57 of 60 rows

Rows per page:

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

NG Lock

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating