Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: OneClick IDM™ Integration Module

CRITICAL RISKRemoved from Chrome Web Store

OneClick IDM™ Integration Module

ID: npchdphadmgajjjfgflalaoklkkmmmom

Could be malicious

Supported Languages

🇸🇦Arabic

🇬🇧British English

🇨🇳Chinese (Simplified)

🇺🇸English

🇩🇪German

🇯🇵Japanese

🇰🇷Korean

🇷🇺Russian

🇺🇦Ukrainian

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

0.2.2

Size

0.13 MB

Rating

5.0/5

Reviews

Users

10,492

Type

Extension

Updated

Nov 19, 2023

Publisher Contextual Analysis

Author: https://tonecfze.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

70,492

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

OneClick IDM™ Integration Module

Internet Download Manager, now in your Chrome browser Adds the "Download with IDM" context menu item for links. In this way, you can download many images, videos and page contents from the internet with a single click.

User Growth

Showing data from Oct 26, 2023 to Nov 21, 2023

Versions

No change in user count

Compared to 26 days ago

2 versions released in this period

Rating Count

Total: 4 ratings+2 (100%)

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium0

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.2.1 Code review	6

Extension Version	Code Review Findings
0.2.1	6

Files with findings

1 distinct path — top paths by unique finding count:

service-worker.js6

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	service-worker.js (line 349)	The right-click handler concatenates a user/options-controlled binary path and arg list with a URL, and forwards them to the native-host child_process.spawn primitive above. Because path/args come from chrome.storage …	0.2.1
2	Privilege Escalation	critical	service-worker.js (line 195)	The extension uses chrome.runtime.sendNativeMessage to a native host named 'com.puupnewsapp' (note: name unrelated to IDM/Tonec) and ships a Node.js script string that invokes child_process.spawn to execute an arbitra…	0.2.1
3	Remote Code Loading	critical	service-worker.js (line 1)	The extension fetches a remote configuration JSON over plaintext HTTP from sayacapp.com.tr (a third-party Turkish domain unrelated to the legitimate Internet Download Manager vendor Tonec). The retrieved values dictat…	0.2.1
4	Phishing	high	service-worker.js (line 261)	On install, the extension fetches the remote config and, if the server returns InstallOpenSite=true, automatically opens an attacker-controlled URL in a new tab. This is a remote-controlled landing-page redirect/affil…	0.2.1
5	Phishing	high	service-worker.js (line 400)	On every browser startup, after a server-controlled launch counter (FeedbackUrlSettings.count) is exceeded, the extension forcibly opens a remote-supplied URL in a new tab. The throttled cadence and remote configurabi…	0.2.1
6	Privilege Escalation	high	service-worker.js (line 545)	Message handlers accept arbitrary 'path' and 'args' values from the options page and persist them to storage; these values are used directly as the executable and arguments in the native-host spawn() call, with no val…	0.2.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
mirror2.internetdownloadmanager.com	/idman638build1.exe	https://mirror2.internetdownloadmanager.com/idman638build1.exe
secure.internetdownloadmanager.com	/buy_idm.html	https://secure.internetdownloadmanager.com/buy_idm.html
sayacapp.com.tr	/SSIDMTonecModule.json	http://sayacapp.com.tr/SSIDMTonecModule.json
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

fine!!

Chrome Extension·19 Nov 2023

nice its work

Kayleigh Cliffson·10 Nov 2023

it works. but first the internet download manager was downloaded

Dustin Cliffson·10 Nov 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

OneClick IDM™ Integration Module

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating