Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Nocturne dark theme

CRITICAL RISKRemoved from Chrome Web Store

Nocturne dark theme

ID: imendndoonjkdkckdhnllocplobgapfc

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.5.2

Size

1.15 MB

Rating

3.8/5

Reviews

Users

300,000

Type

Extension

Updated

Aug 25, 2021

Publisher Contextual Analysis

Author: Danica MajcenView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

300,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Perfect dark themes for the popular websites

Nocturne enables dark themes on popular websites. We maintain, test, and update all the themes regularly. Features: ⭐ Works on many popular web sites. You don’t need several dark theme extensions for every site. ⭐ Add site to the blacklist. If something is wrong you can always add a site to the blacklist. ⭐ Night shift mode. Enable Yellow tint that turns on after subset Feel free to let us know if some site doesn’t work. Please use the review section of the store.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium3

Low3

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.5.1 Code review	4
1.5.0 Code review	6

Extension Version	Code Review Findings
1.5.1	4
1.5.0	6

Files with findings

6 distinct paths — top paths by unique finding count:

background.js4
manifest.json2
content2.js1
css/twitch.css1
css/whatsapp.css1
inject.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	background.js (line 4)	On installation, the extension immediately queries every single open tab (chrome.tabs.query({})) and calls chrome.tabs.executeScript on each one to inject inject.js. This fires at install time before the user has any …	1.5.0
2	Remote Code Loading	high	background.js (line 1)	The background page dynamically injects and executes a remote script from `google-analytics.com`. In a Chrome extension background context, remotely hosted JavaScript is a serious risk because whoever controls that re…	1.5.1
3	Tracking	high	manifest.json (line 1)	The manifest explicitly whitelists Google Analytics, Google APIs, and Google Tag Manager as permitted script sources in the Content Security Policy. A dark theme extension has no legitimate need to load or execute scr…	1.5.0
4	Unauthorized Data Collection	high	background.js (line 2)	A second, undocumented Chrome API polyfill (distinct from the Mozilla webextension-polyfill on line 1) wraps highly sensitive Chrome APIs — including identity.getAuthToken (OAuth token access), captureVisibleTab (tab …	1.5.0
5	Tracking	medium	css/twitch.css (line 97)	This stylesheet causes pages to load an unrelated third-party image over plain HTTP. That both leaks browsing activity to an external host and allows the response to be tampered with in transit, which is an unnecessar…	1.5.1
6	Tracking	medium	inject.js (line 1)	inject.js reads document.location.href on every page at document_start (before DOM load), extracts the hostname, and checks it against a hardcoded list of high-value sites including gmail, drive, dropbox, amazon, gith…	1.5.0
7	Unauthorized Data Collection	medium	manifest.json (line 1)	inject.js is declared as a content script that runs at document_start in all_frames including match_about_blank on <all_urls>. This means the script executes inside every iframe on every page — including dynamically c…	1.5.0
8	Other	low	content2.js (line 1)	content2.js is the entire moment.js v2.24.0 date/time library (65KB) injected as a content script into every webpage at document_start on <all_urls>. A dark theme extension has no legitimate need for a date/time manip…	1.5.0
9	Tracking	low	background.js (line 1)	This code initializes Google Analytics and immediately sends a background-page pageview. While not credential theft, it is explicit telemetry collection from the extension and creates a user-activity signal that is un…	1.5.1
10	Tracking	low	css/whatsapp.css (line 1)	The injected CSS references externally hosted images, including one on `raw.githubusercontent.com`. When this stylesheet is applied on matching pages, the browser will fetch those resources, which can leak that the us…	1.5.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.google-analytics.com	/analytics.js	https://www.google-analytics.com/analytics.js
chrome.google.com	-	https://chrome.google.com
onlinesly.com	-	https://onlinesly.com
momentjs.com	/guides/	http://momentjs.com/guides/#/warnings/define-locale/
momentjs.com	/guides/	http://momentjs.com/guides/#/warnings/js-date/
momentjs.com	/guides/	http://momentjs.com/guides/#/warnings/min-max/
momentjs.com	/guides/	http://momentjs.com/guides/#/warnings/add-inverted-param/
momentjs.com	/guides/	http://momentjs.com/guides/#/warnings/zone/
momentjs.com	/guides/	http://momentjs.com/guides/#/warnings/dst-shifted/
static.xx.fbcdn.net	/rsrc.php/v2/yV/r/R3gnFfkFEmR.png	https://static.xx.fbcdn.net/rsrc.php/v2/yV/r/R3gnFfkFEmR.png

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.3 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

This thing was ok. I had a little problems but yeah, its cool

Kaylee Chang·13 Jul 2021

Me encantó, había instalado otra extención pero no me funciono esta esta increible :3

JohaDinorah TurruHernández·8 Jul 2021

It's not gray it's more of a white.

envuta·19 Apr 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Nocturne dark theme

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews