Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: ГдеПосылка: отслеживание почтовых отправлений

CRITICAL RISKRemoved from Chrome Web Store

ГдеПосылка: отслеживание почтовых отправлений

ID: pleaojdbmipmniiafnfmiainmdhkomgn

Could be malicious

Supported Languages

🇺🇸English

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

0.3.5

Size

0.37 MB

Rating

4.9/5

Reviews

8,594

Users

200,000

Type

Extension

Updated

Jan 17, 2022

Publisher Contextual Analysis

Author: https://gdeposylka.ruView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

200,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Плагин отслеживания почтовых отправлений. Трекинг посылок с сайтов AliExpress и JD. Отследить посылку с АлиЭкспресс стало проще.

Где Посылка — сервис отслеживания почтовых отправлений различных служб доставки. Быстрое добавление в отслеживание с информацией о товаре с сайтов AliExpress, JS, GearBest. При изменении статуса отправления вы увидите индикатор на иконке приложения в панеле управления. Открыв окно расширения вы увидите последние статусы и месторасположения ваших посылок и заказов не переходя на сторонние сайты отслеживания. Возможности расширения: — удобное отслеживание по трекинг номерам через контекстное меню; — быстрое добавление заказов AliExpress в отслеживание со списка заказов; — отслеживание посылок сразу по нескольким службам; — подписка на обновления статусов; — уведомления об изменении статуса посылки.

User Growth

Showing data from Jan 01, 2022 to Mar 16, 2022

Versions

No change in user count

Compared to 2 months ago

2 versions released in this period

Rating Count

Total: 8,594 ratings

Average Rating

Current: 4.90 / 5.0-0.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High3

Medium0

Low1

Versions scanned

Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.3.4 Code review	8

Extension Version	Code Review Findings
0.3.4	8

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js5
js/sites/everywhere.widget.js2
js/sites/gdeposylka.sync.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.js (line 558)	The ping function fetches a dynamic URL (e.g) from a remote server, retrieves its content, and exfiltrates it along with the user's UUID and referrer to another remote URL (e.r). This allows for remote-controlled data…	0.3.4
2	Data Exfiltration	critical	js/background.js (line 606)	Exfiltrates full page content to a third-party server (alitr.ru) based on server-side regex rules. This allows the extension to dynamically target and steal data from specific websites without updating the extension c…	0.3.4
3	Data Exfiltration	critical	js/background.js (line 6948)	The extension polls a remote endpoint, then uses server-supplied fields `e.g` and `e.r` to fetch arbitrary content and exfiltrate it back in compressed form together with a persistent UUID, current URL, and referrer. …	0.3.4
4	Unauthorized Data Collection	critical	js/sites/everywhere.widget.js (line 53)	This function captures the entire HTML of the current page (outerHTML) and sends it to the background script for exfiltration. While currently active on AliExpress/Gearbest, the background script's server-side configu…	0.3.4
5	Data Exfiltration	high	js/background.js (line 6995)	This function uploads captured page data to a remote server after checking allow/deny regexes stored in extension settings. Because those regexes are loaded remotely elsewhere in the extension, the operator can centra…	0.3.4
6	Obfuscation	high	js/background.js (line 583)	Uses the pako library to deflate (compress) exfiltrated data before sending it as a binary blob ('binson') via POST. This acts as a form of obfuscation to hide the nature of the stolen data from network monitoring tools.	0.3.4
7	Unauthorized Data Collection	high	js/sites/everywhere.widget.js (line 71)	On AliExpress pages, the content script captures the entire page HTML (`document.all[0].outerHTML`), current URL, referrer, and extracted product IDs, then forwards that data to the background script for upload. This …	0.3.4
8	Tracking	low	js/sites/gdeposylka.sync.js (line 1)	The extension writes persistent installation-marker cookies on the vendor's domains, allowing the site to detect and track extension presence over time. It also ingests user info from a page-controlled meta tag and fo…	0.3.4

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


packageradar.com	/detect/	http://packageradar.com/detect/
gdeposylka.ru	/detect/	https://gdeposylka.ru/detect/
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
developer.mozilla.org	/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage	https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage
alitr.ru	-	https://alitr.ru
packageradar.com	-	https://packageradar.com
gdeposylka.ru	-	https://gdeposylka.ru
gdeposylka.ru	/api/v5/jsonrpc	https://gdeposylka.ru/api/v5/jsonrpc
trade.aliexpress.com	/order_detail.htm	https://trade.aliexpress.com/order_detail.htm?orderId=
gdeposylka.ru	/img/logo-header-xs-v3.png	https://gdeposylka.ru/img/logo-header-xs-v3.png

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Зачем делать две строчки - "Заказы на АлиЭкспресс" и "Мои за��азы на АлиЭкспресс" ??? Хотя эти же посылки еще и в "Моих посылка��" !!! Мало того, так эти "Заказы на Али��кспрессе" висят вечно, уже д��вно все получено и удалено, а тут нет - нарисован красный квадратик с ��оличеством ��осылок...

LEON·19 Feb 2022

Зачем делать две строчки - "За��азы на АлиЭкспресс" и "Мои за��азы на АлиЭкспресс" ??? Хотя эти же посылки еще и в "Моих посылка��" !!! Мало того, так эти "Заказы на Али��кспрессе" висят вечно, уже д��вно все получено и удалено, а тут нет - нарисован красный квадратик с ��оличеством ��осылок...

LEON·19 Feb 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

ГдеПосылка: отслеживание почтовых отправлений

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews