Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Pinterest video downloader

CRITICAL RISKRemoved from Chrome Web Store

Pinterest video downloader

ID: eichomdindbdobljgncagfpbllmgncip

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.0.0

Size

0.04 MB

Rating

3.8/5

Reviews

Users

6,000

Type

Extension

Updated

Sep 2, 2022

Publisher Contextual Analysis

Author: Easy DownloadView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

149,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Pinterest video downloader is an extension for downloading videos from Pinterest

Why this Pinterest video downloader? - Unlimited download - No ads - No sponsored links - Completely free - Download instantly at your highest speed - Works on multiple operating systems (Windows, Mac OS and Linux) - No need to install additional software How to use： - Go to the Pinterest website and open Pinterest video - Click on Download button Please be careful not to download too many videos at once, because Pinterest can block you temporarily because of too many downloads (about five minutes). IMPORTANT: The extension doesn't collect browsing history. To send information from the background script to the content_scripts Pinterest video downloader needs the tabs permission which triggers the warning for the browsing history. Is Pinterest video downloader legal? Yes, as long as you download the video for your personal offline use, you probably won't do anything illegal. However, if you want to share them in the community or for commercial use, you will need the author's consent. Disclaimer: Pinterest video downloader is not an official plugin. Pinterest™ is a trademark of Pinterest, Inc.

User Growth

Showing data from Aug 24, 2022 to Aug 23, 2023

Versions

-10.07%(-672 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 4 ratings

Average Rating

Current: 4.25 / 5.0+4.25

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.0 Code review	8

Extension Version	Code Review Findings
1.0.0.0	8

Files with findings

4 distinct paths — top paths by unique finding count:

js/background.js5
js/connector.js1
js/provider.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	js/background.js (line 61)	The `allowOrigin()` function reads `dnl_settings` from storage — content fetched from the third-party server `pintervid.space` — and uses it to install `declarativeNetRequest` rules that modify HTTP response headers o…	1.0.0.0
2	Privilege Escalation	critical	js/background.js (line 253)	The background service worker implements a generic RPC proxy that traverses the `chrome` object using an attacker-controlled `api_chain` array and invokes the resolved function with attacker-controlled `params`. Becau…	1.0.0.0
3	Privilege Escalation	critical	js/connector.js (line 63)	This event listener forwards every `window.postMessage` event to the background service worker's privileged `messageHandler` without validating `event.origin`. Any web page in the same tab can craft a `chrome_api` mes…	1.0.0.0
4	Remote Code Loading	critical	js/provider.js (line 166)	The extension fetches configuration from a third-party domain (`pintervid.space`) that is unrelated to Pinterest and stores the response directly into `chrome.storage.local` as `dnl_settings`. This remote config is th…	1.0.0.0
5	Code Injection	high	js/background.js (line 170)	On tab disconnect, the extension reads a `d_cbs` array from `chrome.storage.local` and executes each entry as a Chrome API call by traversing an attacker-controlled `cb.c` chain with `cb.p` params. Since the sandbox c…	1.0.0.0
6	Network Interception	high	js/background.js (line 46)	The extension intercepts outbound XHR requests to `pinterest.com`, reads the `x-retpath-y` header (a Pinterest internal header used to track navigation origin), and silently sets a `pinterest` cookie when the value de…	1.0.0.0
7	Unauthorized Data Collection	high	js/background.js (line 204)	The `keepAlive()` function queries ALL open browser tabs (`:///*`) and injects `connector.js` into them via `chrome.scripting.executeScript`. This far exceeds the extension's stated Pinterest-only scope and establis…	1.0.0.0
8	Code Injection	medium	manifest.json (line 90)	The sandbox page CSP explicitly allows `unsafe-eval` and `unsafe-inline` in both `script-src` and `script-src-elem` directives. Since the sandbox page (`sandbox.html`) loads `provider.js` which communicates bidirectio…	1.0.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///
www.pinterest.com	-	https://www.pinterest.com
www.pinterest.com	-	https://www.pinterest.com/
www.pinterest.com	/*	https://www.pinterest.com/*
pintervid.space	/pinterest/	https://pintervid.space/pinterest/

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.0	IPv4	-

4.1 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

this is one of the most important extensions ive had and i just wana say thx for making this

Karthikeyan Kaushi Devasena (Grps)·9 Mar 2024

FRIEND, THE PHOTOS ON THE FIRST PAGE OF PINTEREST ARE BEING DOWNLOADED IN 236X354, fix this for us, thanks

youtube noticia·14 Feb 2024

This extension is useless and not important it doesn't do what is says it does

Medutoni Richchild

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Pinterest video downloader

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating