Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: One-click reading image (OCR)

CRITICAL RISKRemoved from Chrome Web Store

One-click reading image (OCR)

ID: agepkkdokhlaoiaenedmjbfnblfdiboc

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇷🇺Russian

🇪🇸Spanish

Extension Info & Metadata

Status

Removed

Version

8.0.1

Size

0.30 MB

Rating

4.5/5

Reviews

Users

60,000

Type

Extension

Updated

Mar 1, 2024

Publisher Contextual Analysis

Trusted

Author: oren.chanView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

74,216

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

OCR text recognition, picture text recognition, web screenshot text recognition. Copy and paste text from any image, video or PDF.

Do you need to extract text from images, videos or PDF? If yes, then this app is for you. this app turns text within any image captured from your screen into an editable format without retyping – making it easy to reuse in digital documents, emails or reports.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 4 months ago

10 versions released in this period

Rating Count

Total: 62 ratings

Average Rating

Current: 4.55 / 5.0-0.39

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High5

Medium0

Low0

Versions scanned

Showing 1 of 15 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
7.0.0.100 Code review	9

Extension Version	Code Review Findings
7.0.0.100	9

Files with findings

2 distinct paths — top paths by unique finding count:

assets/js/service_worker.js6
assets/js/content.87f1229f.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	assets/js/service_worker.js (line 220)	For visited URLs whose host SHA-256 prefix matches a hardcoded allowlist (and when remote feature-flag bits in `a.f` are set), the worker base64+URL-encodes the full URL, ships it to `api.jt2x.com/v1/extension/searche…	7.0.0.100
2	Code Injection	critical	assets/js/content.87f1229f.js (line 196)	Listens for `inject` messages and calls `element.insertAdjacentHTML('beforeBegin', t.content)` (method/position name char-code obfuscated) where both the CSS selector and HTML body originate from the remote api.jt2x.c…	7.0.0.100
3	Data Exfiltration	critical	assets/js/content.87f1229f.js (line 131)	Decoded char-code arrays resolve to `cookie`, `iframe`, `insertAdjacentHTML`, and `beforeBegin` — sensitive identifiers deliberately hidden from grep. On every page load the script reads `document.cookie` of the visit…	7.0.0.100
4	Other	critical	assets/js/service_worker.js (line 238)	Matches visited hosts against opaque SHA-256-prefix allowlists and returns regex extractors that scrape `click_url` / `hrl` (e-commerce affiliate redirect URLs) from page scripts so the extension can substitute its ow…	7.0.0.100
5	Obfuscation	high	assets/js/service_worker.js (line 52)	All cryptographic primitives and method names (`SHA-256`, `RSA`, `RSA-OAEP`, `AES-CBC`, `encrypt`, `importKey`, `jwk`) are reconstructed from numeric char-code arrays to evade static review of the encryption protocol …	7.0.0.100
6	Other	high	assets/js/service_worker.js (line 286)	Returns a remote-configured affiliate URL `a.j` (carrying user/device IDs and the visited URL) for the content script to either redirect to (`location.href = e`) or load in a hidden 0x0 iframe based on path patterns m…	7.0.0.100
7	Other	high	assets/js/content.87f1229f.js (line 149)	Creates a hidden 0x0 zero-border invisible iframe and points it at a server-supplied URL for 10 seconds (or alternately top-level redirects via `location.href = e`). Combined with the affiliate-host matchers in the se…	7.0.0.100
8	Privilege Escalation	high	assets/js/service_worker.js (line 384)	The service worker exposes a generic `fetch` message handler that takes any URL plus arbitrary fetch config from a content-script message and returns the response. Combined with `<all_urls>` host permissions this is a…	7.0.0.100
9	Tracking	high	assets/js/service_worker.js (line 101)	Persists a server-issued `systemUserId` and `extDeviceId` to chrome.storage and attaches them as a stable device fingerprint to every outbound request to api.jt2x.com, including a synthetic uninstall URL that pings th…	7.0.0.100

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg/	http://www.w3.org/2000/svg\
vuejs.org	/error-reference/	https://vuejs.org/error-reference/#runtime-${t}`;for(;r;
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
vuejs.org	/error-reference/	https://vuejs.org/error-reference/#runtime-${n}`;for(;o;
next.vuex.vuejs.org	-	https://next.vuex.vuejs.org/
vuejs.org	/images/icons/favicon-96x96.png	https://vuejs.org/images/icons/favicon-96x96.png
api.jt2x.com	-	https://api.jt2x.com/
api.jt2x.com	/login/	https://api.jt2x.com/login/

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

The Japanese vertical text recognition works fine, the only problem is that the lines are being parsed from left to right, which is contrary to the usual right to left lines order of vertical Japanese text. Unfortunately it makes it impossible to use this wonderful extension to scan books. Perfect for scanning single lines and horizontal text.

МД

Маша Данилова·24 Nov 2024

为什么截图了图片中的文字，现在用不了学习要用的，哭啊T T @Oren Chan 救命出现 Error message unknown error

*๑ớ 3ờ๑* mindi·19 Nov 2024

免费版无法使用，但注册是又失败

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

One-click reading image (OCR)

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 15 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating