Security Warning: High Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: OrangeMonkey

HIGH RISK

OrangeMonkey

ID: ekmeppjgajofkpiofbebgcbohbmfldaf

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Active

Version

2.0.14

Size

0.71 MB

Rating

3.0/5

Reviews

1,063

Users

1,000,000

Type

Extension

Updated

Jul 28, 2026

Publisher Contextual Analysis

Author: exten.helperView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,200,000

Lightweight Userscript manager. Provides userscripts support for Chromium browsers

OrangeMonkey is a lightweight userscript manager. Fork of the popular Violentmonkey extension with enhanced functionality and updated design. OrangeMonkey is used to run called userscripts. Using them, you can, for example, make a dark theme for your favorite site. Features: - Ability to make backups by saving your entire gallery in a zip archive - Installing userjs by link - Large userjs gallery available and search through it - Convenient one-click script switching - All GM_ * functions available Changelog: - v1.0.2 - Updated popup

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-50%(-1,000,000 users)

Compared to 3 months ago

2 versions released in this period

Rating Count

Total: 125 ratings

Average Rating

Current: 2.77 / 5.0-0.32

Item	Type	Severity	Description
scripting	Permission	Critical	This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
webRequest	Permission	Critical	This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
declarativeNetRequest	Permission	Critical	This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
:///*	Host	Critical	Broad host access — the extension can read/modify content on every website.
downloads	Permission	High	This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
offscreen	Permission	High	This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 10% increase: Early script execution enables pre-emptive content manipulation
Broad Host Permissions	Risk Factor	High	This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access	Risk Factor	High	This extension can inject scripts into any website.
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
unlimitedStorage	Permission	Medium	This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.
notifications	Permission	Low	This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.
userScripts	Permission	Unknown	No classification available for this permission.

The bundled manifest declares the 'declarativeNetRequest' permission, but the live CWS listing summary does not include it. This discrepancy may indicate a permissions update not yet reflected in the listing or a misconfiguration.

manifest.json (Line 1)

// Bundled manifest.json includes "declarativeNetRequest" in permissions,// but the Chrome Web Store published summary (from live CWS listing)// lists permissions without it."permissions": ["tabs", "scripting", "notifications", "downloads", "storage", "unlimitedStorage", "offscreen", "webRequest", "userScripts", "declarativeNetRequest"]

The extension sends a screenview hit to Google Analytics (UA-142528268-15) that includes the `cd1` parameter set to a semicolon-separated list of installed script names (`e`). This transmits sensitive user information (installed script inventory) to a third party without any disclosure in the CWS privacy practices (listed as 'none declared').

background.js (Line 680)

g = {  init: function(e) {    m({        trackTimeout: null      })      .then((function(t) {        var n = t.trackTimeout;        n && d() < n || !e || m({            uuid: null          })          .then((function(e) {            if (e.uuid) return e.uuid;            var t = v();            return h({              uuid: t            }), t          }))          .then((function(t) {            var n = {              v: 1,              t: "screenview",              tid: "UA-142528268-15",              cid: t,              cd: "init",              av: chrome.runtime.getManifest()                .version,              an: "OrangeMonkey",              ul: chrome.i18n.getMessage("@@ui_locale"),              cd1: e            };            fetch("https://www.google-analytics.com/collect", {                method: "POST",                body: Object.keys(n)                  .map((function(e) {                    return "".concat(encodeURIComponent(e), "=")                      .concat(encodeURIComponent(n[e]))                  }))                  .join("&")              })              .then((function(e) {                h({                  trackTimeout: d() + 43200                })              }))          }))      }))  },  ...}

By severity

Critical0

High2

Medium0

Low0

Versions scanned

Showing 1 of 18 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.14 Code review	2

Extension Version	Code Review Findings
2.0.14	2

Files with findings

2 distinct paths — top paths by unique finding count:

background.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Other	high	manifest.json (line 1)	The bundled manifest declares the 'declarativeNetRequest' permission, but the live CWS listing summary does not include it. This discrepancy may indicate a permissions update not yet reflected in the listing or a misc…	2.0.14
2	Unauthorized Data Collection	high	background.js (line 680)	The extension sends a screenview hit to Google Analytics (UA-142528268-15) that includes the `cd1` parameter set to a semicolon-separated list of installed script names (`e`). This transmits sensitive user information…	2.0.14

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.


github.com	/facebook/regenerator/blob/main/LICENSE	https://github.com/facebook/regenerator/blob/main/LICENSE
developer.mozilla.org	/docs/Web/JavaScript/Reference/Global_Objects/n	http://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects\n
developer.mozilla.org	/docs/Web/API/Window/n	http://developer.mozilla.org/docs/Web/API/Window\n
wiki.greasespot.net	/Greasemonkey_Manual:API/n	http://wiki.greasespot.net/Greasemonkey_Manual:API\n
www.google-analytics.com	/collect	https://www.google-analytics.com/collect
www.google-analytics.com	/mp/collect	https://www.google-analytics.com/mp/collect
www.google-analytics.com	/debug/mp/collect	https://www.google-analytics.com/debug/mp/collect
wiki.greasespot.net	/@grant	http://wiki.greasespot.net/@grant
www.webtoolkit.info	/javascript-utf8.html	http://www.webtoolkit.info/javascript-utf8.html
developer.mozilla.org	/docs/Web/JavaScript/Reference/Global_Objects	http://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects

Showing 1 to 10 of 30 rows

Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

perfect

Sabelo Dlamini·24 Jul 2026

good

iwal mkw·22 Jul 2026

good

Friday·16 Jul 2026

Version	Size	Is Malicious	Findings	Permhash
2.0.15 Latest	0.71 MB	Benign	—	319797cd462d3c4bfec9dc650849bb8c870a58b3af6b3bac5e2d68ce191c4202
2.0.14	0.71 MB	Malicious	2	319797cd462d3c4bfec9dc650849bb8c870a58b3af6b3bac5e2d68ce191c4202
2.0.12	0.71 MB	Benign	—	c22d164649e7f46fe63d218064f085c29ee2926b2cb459236f8245deae3a6ac2
2.0.11	0.71 MB	Benign	—	c22d164649e7f46fe63d218064f085c29ee2926b2cb459236f8245deae3a6ac2
2.0.10	0.73 MB	Benign	—	c22d164649e7f46fe63d218064f085c29ee2926b2cb459236f8245deae3a6ac2
2.0.9	0.71 MB	Benign	—	c22d164649e7f46fe63d218064f085c29ee2926b2cb459236f8245deae3a6ac2
2.0.6	0.71 MB	Benign	—	c22d164649e7f46fe63d218064f085c29ee2926b2cb459236f8245deae3a6ac2
1.0.9	0.68 MB	Benign	—	a5e5b86d23ed678cd69a5b6bf302c4a119dde9684be54c8e47ce022d5e40d366
1.0.8	0.68 MB	Benign	—	a5e5b86d23ed678cd69a5b6bf302c4a119dde9684be54c8e47ce022d5e40d366
1.0.7	0.68 MB	Benign	—	a5e5b86d23ed678cd69a5b6bf302c4a119dde9684be54c8e47ce022d5e40d366

Showing 1 to 10 of 20 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Warning: High Security Risk

OrangeMonkey

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Code Analysis

Code Review Findings Summary Across 18 Versions2

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating

Security Warning: High Security Risk

OrangeMonkey

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Code Analysis

Otherhighmanifest.json

Unauthorized Data Collectionhighbackground.js

Code Review Findings Summary Across 18 Versions2

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating