Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Planets in Space Wallpapers New Tab

CRITICAL RISKRemoved from Chrome Web Store

Planets in Space Wallpapers New Tab

ID: jndngcchpjpfainplmbdlibfiiofghgp

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇳Hindi

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇵🇹Portuguese

🇷🇺Russian

🇪🇸Spanish

🇹🇭Thai

🇹🇷Turkish

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

1.5.0.7

Size

18.14 MB

Rating

0.0/5

Reviews

Users

100,000

Type

Extension

Updated

Apr 26, 2022

Publisher Contextual Analysis

Trusted

Author: https://newtab.icuView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

128

Active

Obsolete

128

Listed

128

Unlisted

Total Users

4,515,043

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Planets in Space theme in new tab

Comfortable wallpapers for your browser in a tabs. Planets in Space Wallpapers New Tab - browser extension that opens accessibility options for setting up a tabs. Planets in Space Wallpapers New Tab extension possibilities: 1. Shortcuts Save your favorite sites to the Planets in Space New Tab bookmark bar. You can go to important and frequently visited websites with just one click. 2. Full HD Wallpaper Instead of a boring gray background, there will be gorgeous wallpapers in Full HD from the extension Planets in Space New Tab. 3. Search engine The search bar provides quick access to the largest and most popular search engines in the world. 4. News panel The bottom panel shows news videos of the world's official news agencies published on the YouTube platform. By installing and using this extension Planets in Space Wallpapers New Tab, you automatically accept the User Agreement https://newtab.icu/agreement and the Privacy Policy https://newtab.icu/privacy

User Growth

Showing data from Apr 12, 2022 to May 31, 2022

Versions

No change in user count

Compared to 2 months ago

2 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High2

Medium2

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.5.0.5 Code review	6

Extension Version	Code Review Findings
1.5.0.5	6

Files with findings

3 distinct paths — top paths by unique finding count:

french_sky_blue_lyra.js3
meitnerium830.js2
fuzzy_wuzzy_roentgenium.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	french_sky_blue_lyra.js (line 15)	On install the service worker contacts the publisher's server, parses the HTML response to extract whatever URL sits in a `src` attribute, then silently fetches that server-controlled URL with `credentials: 'include'`…	1.5.0.5
2	Remote Code Loading	critical	meitnerium830.js (line 38)	The entire new tab page is rendered inside a full-screen sandboxed iframe whose `src` is a publisher-controlled URL. The operator can change the displayed content — ads, phishing pages, malicious scripts permitted by …	1.5.0.5
3	Privilege Escalation	high	fuzzy_wuzzy_roentgenium.html (line 20)	The sandbox attribute grants the remote iframe `allow-same-origin` combined with `allow-scripts`, which nullifies sandbox isolation — a sandboxed iframe with both flags can escape its sandbox. Combined with `allow-top…	1.5.0.5
4	Tracking	high	french_sky_blue_lyra.js (line 2)	Every install and uninstall fires a credentialed ping to the publisher's server keyed by the unique `chrome.runtime.id`. This lets the operator maintain a real-time install/uninstall registry of individual extension i…	1.5.0.5
5	Obfuscation	medium	french_sky_blue_lyra.js (line 1)	Dead variables (`cotton_candy`, `cyclamen`) and a dead function (`erin463`) containing only random numeric string literals are scattered throughout functional code. This is a textbook fingerprint-padding obfuscation t…	1.5.0.5
6	Obfuscation	medium	meitnerium830.js (line 2)	Same obfuscation pattern as the service worker: dead color-named variables holding random numeric strings interspersed with functional logic, consistent with automated padding to break static signatures across the pub…	1.5.0.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
planets-in-space.newtab.icu	-	https://planets-in-space.newtab.icu/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.5.0.7	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Planets in Space Wallpapers New Tab

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating