Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: PicPay Shop

CRITICAL RISKRemoved from Chrome Web Store

PicPay Shop

ID: kacpcojbcbeejfmpcdflgeemieobaafc

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

Extension Info & Metadata

Status

Removed

Version

1.19.1

Size

2.96 MB

Rating

3.6/5

Reviews

Users

10,000

Type

Extension

Updated

Jan 30, 2024

Publisher Contextual Analysis

Author: picpayView Profile
Privacy: Privacy Policy
Country: BR
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: Av. Manuel Bandeira, 291 São Paulo, SP 05317-020 BR

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Ganhe cashback e cupons de desconto com a PicPay Shop

Com a extensão do PicPay Shop você pode ganhar dinheiro de volta também nas compras pelo computador. É fácil, seguro e totalmente gratuito. Economize nas suas compras online com poucos cliques e receba seu cashback na sua Carteira no app do PicPay pra usar como quiser. Para começar a ganhar dinheiro de volta é fácil: basta baixar a extensão, logar na sua conta do PicPay e ativar o cashback antes de realizar suas compras. Depois, é só acompanhar pelo app do PicPay os status do seu cashback. O uso de outras extensões pode cancelar seu cashback. Por isso, recomendamos que você utilize apenas a extensão do PicPay Shop para realizar suas compras. Em caso de dúvidas, acesse: https://meajuda.picpay.com/hc/pt-br/sections/12670108522515 Ao continuar, você concorda com os Termos de Uso e Política de Privacidade: https://picpay.com/app_webviews/terms https://picpay.com/politica-de-privacidade

User Growth

Showing data from Apr 05, 2023 to Apr 03, 2024

Versions

No change in user count

Compared to 3 months ago

29 versions released in this period

Rating Count

Total: 22 ratings

Average Rating

Current: 4.64 / 5.0-0.36

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High2

Medium2

Low0

Versions scanned

Showing 1 of 29 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.7.0 Code review	5

Extension Version	Code Review Findings
1.7.0	5

Files with findings

1 distinct path — top paths by unique finding count:

background/main.esm.js5

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	background/main.esm.js (line 3)	The OAuth2 client secret (`ufTrzXujvBUVOZCaTunqxS1gUb6FDt7S`) is hardcoded in plaintext inside the distributed extension package. Any user who installs the extension can extract this secret from the CRX file and use i…	1.7.0
2	Tracking	high	background/main.esm.js (line 208)	The extension fetches a "blacklist" of domain URLs from the remote server (`/affiliate/extension/blacklists`) and then uses `chrome.tabs.query` to scan ALL currently open browser tabs against every entry in that list.…	1.7.0
3	Unauthorized Data Collection	high	background/main.esm.js (line 313)	The background service worker registers listeners on `chrome.tabs.onUpdated` AND `chrome.tabs.onHighlighted` (line 361), both of which call `handleTabHasCashback`. On every tab update or focus change — covering the us…	1.7.0
4	Privilege Escalation	medium	background/main.esm.js (line 292)	The `chrome.runtime.onMessage` handler dispatches incoming messages by calling `this.backgroundFacade[method](params)` where `method` is an arbitrary string from the message. There is no allowlist of permitted method …	1.7.0
5	Unauthorized Data Collection	medium	background/main.esm.js (line 106)	After receiving an OAuth access token, the extension manually base64-decodes the JWT payload (`atob(access_token.split(".")[1])`) and extracts the `sub` claim, then base64-decodes a segment of that claim to derive a `…	1.7.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

209

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


bugs.webkit.org	/show_bug.cgi	https://bugs.webkit.org/show_bug.cgi?id=49739
jedwatson.github.io	/classnames	http://jedwatson.github.io/classnames
polymer.github.io	/LICENSE.txt	http://polymer.github.io/LICENSE.txt
polymer.github.io	/AUTHORS.txt	http://polymer.github.io/AUTHORS.txt
polymer.github.io	/CONTRIBUTORS.txt	http://polymer.github.io/CONTRIBUTORS.txt
polymer.github.io	/PATENTS.txt	http://polymer.github.io/PATENTS.txt
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
github.com	/jonathantneal/closest	https://github.com/jonathantneal/closest
developer.mozilla.org	/en-US/docs/Web/API/HTMLElement/offsetParent	https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/offsetParent
github.com	/zloirock/core-js	https://github.com/zloirock/core-js

Showing 1 to 10 of 210 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


15.9.1.11	IPv4	-
5.62.31.31	IPv4	-
174.11.35.15	IPv4	-
1.5.77.77	IPv4	-
54.54.94.94	IPv4	-
33.21.94.94	IPv4	-
62.22.91.91	IPv4	-
54.54.84.84	IPv4	-
121.122.233.21	IPv4	-
122.129.233.22	IPv4	-
1.38.91.91	IPv4	-
1.38.94.94	IPv4	-
9.27.83.83	IPv4	-
22.33.94.94	IPv4	-
12.132.23.22	IPv4	-
21.33.94.94	IPv4	-
38.107.24.3	IPv4	-
118.122.226.21	IPv4	-
207.168.33.22	IPv4	-
84.62.92.92	IPv4	-
12.15.76.76	IPv4	-
2.8.14.14	IPv4	-
7.3.93.93	IPv4	-
1.99.94.94	IPv4	-
12.91.29.29	IPv4	-
21.32.84.84	IPv4	-
4.24.71.7	IPv4	-
71.7.7.7	IPv4	-
1.44.62.89	IPv4	-
225.101.48.115	IPv4	-

Showing 1 to 30 of 30 rows

Rows per page:

2.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Extensão não funciona mais.

Alexandre Correa Pereira·29 Nov 2024

Não funciona mais, fica pedindo "permissão" para acessar a conta e nada é carregado

Ed Duarte·21 Jul 2024

Parou de funcionar, faço login e a extensão continua pedindo pra fazer login eternamente.

Cássio Alves

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

PicPay Shop

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 29 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews