Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 橙光日历

CRITICAL RISKRemoved from Chrome Web Store

橙光日历

ID: ocbgooipmfjolciehamjinlnjegkhlko

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

9.16.121

Size

0.09 MB

Rating

3.9/5

Reviews

Users

200,000

Type

Extension

Updated

Jun 27, 2024

Publisher Contextual Analysis

Trusted

Author: sundanqcView Profile
Privacy: Privacy Policy
Country: 中国
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 浙桥路277号2号楼上海 201200 中国

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,020,081

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

这是一款简单、实用的生活万年历。主要包含了农历、实时假日、黄历等实用功能。

橙光日历是一个扩展应用，安装成功后，点击右上方图标按钮，弹出popup页面，展示出橙光日历的主界面。年份可以选择1900到2050年，鼠标移动上去有天干地支的年月日。

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 5.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High2

Medium1

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.13.81 Code review	5

Extension Version	Code Review Findings
2.13.81	5

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.js4
js/content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	js/background.js (line 453)	This is the `webRequest` callback's decision point: after evaluating remotely supplied rules, it logs the victim URL and returns a blocking modification object that rewrites the navigation target to `q.dest`. In pract…	2.13.81
2	Remote Code Loading	critical	js/background.js (line 519)	This code dynamically indexes into the `chrome` API using values loaded from storage (`w`, `r`, `a`, `u`, `b`, `rf`, `tu`) rather than hardcoded extension logic. Elsewhere, that storage is populated from server-suppli…	2.13.81
3	Privilege Escalation	high	js/content.js (line 151)	The content script accepts arbitrary `window.postMessage` input from any web page and forwards the message payload directly to the extension background page. Because this content script runs on all `http` and `https` …	2.13.81
4	Privilege Escalation	high	js/background.js (line 480)	The background page exposes a generic XMLHttpRequest helper that can send requests to attacker-chosen URLs with attacker-controlled method, body, and content type. Combined with the page message bridge in `content.js`…	2.13.81
5	Tracking	medium	js/background.js (line 168)	The extension sends telemetry to a remote server via image beacons. Other code paths populate these events with a persistent generated `gid`/`uid`, version, channel, counters, and browsed URL data, which amounts to us…	2.13.81

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


domain.com	/path/to/somewhere/	http://domain.com:8080/path/to/somewhere/?foo=bar#hash
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

垃圾扩展，打开别的网页，会自动打开并跳转到360网页导航。

yan qi·15 Jul 2024

垃圾扩展，打开别的网页，会自动打开并跳转到360网页导��。

yan qi·15 Jul 2024

Hello, I hope you're having a splendid day! I am currently seeking opportunities to expand my business operations by investing in extensions with a significant user base, beginning from 50,000 users and up. No matter if your extension has a modest user base or counts its users in the millions, I am interested and ready to negotiate a purchase. If you are in possession of such an extension and looking to turn it into a profit, please consider reaching out to me. We can discuss the price and proceed with a transparent and secure transaction through a trusted escrow service based in the United States. It's great that Google allows the transfer of extension ownership between accounts, so your Google account ownership will remain intact. If you have any needs, please contact us via the following contacts Whatsapp: +1 (248) 896‑8035 Telegram: t.me/harryysandersonn

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

橙光日历

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating