Security Warning: Historically Flagged as Malware
Preppy Cursor ★ Custom Cursor for Chrome™
ID: dobjkkoopofegeinkiepblgidnigchoo
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://owhit.comView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Cute and colorful preppy cursors! 40+ icons to match your aesthetic vibe
Add a splash of color and charm to your browser with the Preppy Cursor collection! 💅🌈 From hearts and smiley faces to bows, lightning bolts, flowers, and butterflies – this pack brings 40+ aesthetic cursors to match your vibe. 🔸 Features 🎀 40+ Stylish Preppy Cursors – Cute, colorful, and full of personality. ✨ Trendy Designs – Inspired by TikTok, Y2K, and pastel aesthetics. 🖱️ Easy Switching – Choose your favorite cursor with just a click. 🎨 Resizable Options – Customize the size to your liking. ⚡ Smooth Browsing – Lightweight and fast performance. 💖 Favorites Tab – Save the ones that match your mood. 💅 Perfect For 🎨 Aesthetic lovers and TikTok fans. 🌸 Anyone who loves vibrant, girly, and playful styles. 💻 Customization fans who want a cute and fun browsing experience.
On install, the extension immediately opens a tab navigating to yowgames.com with UTM parameters that fingerprint the event as an extension install. The uninstall URL similarly reports uninstall events back to yowgames.com. Together these form a behavioral telemetry system tracking user install/uninstall actions without disclosure.
chrome.runtime.onInstalled.addListener(function(details) { if (details.reason === "install") { chrome.storage.local.set({ switch_status: "true", default_cursor: "", pointer_cursor: "", default_cursor_result: "", pointer_cursor_result: "", default_curSize: "48", pointer_curSize: "48", favorites: [] }); // Kurulum sonrası hoş geldiniz sayfasını aç chrome.tabs.create({ url: "https://yowgames.com/preppy-cursor-%e2%98%85-custom-cursor-for-chrome/?utm_source=install&utm_medium=link&utm_campaign=bg&utm_content=install" }); }});// Uzantı kaldırıldığında çalışacakchrome.runtime.setUninstallURL( "https://yowgames.com/preppy-cursor-%e2%98%85-custom-cursor-for-chrome/?utm_source=Uninstall&utm_medium=link&utm_campaign=bg&utm_content=Uninstall");The content script is injected at `document_start` into every frame (including iframes) on every HTTP/HTTPS URL. `document_start` fires before any page DOM or scripts exist, giving the extension the earliest possible execution foothold. While some cursor extensions require this, injecting into all_frames universally is more aggressive than necessary for cursor styling.
{ "content_scripts": [ { "all_frames": true, "js": [ "cursorcontent.js" ], "matches": [ "*://*/*" ], "run_at": "document_start" } ]}The style element ID is `demonslayer-impact-cursor-style`, which does not match this extension's branding ('Preppy Cursor'), strongly suggesting the code was cloned from a different cursor extension. Additionally, `data.default_cursor_result` and `data.pointer_cursor_result` from storage are interpolated directly into CSS without validation that they are safe data URLs; if storage were compromised by another vector, this could enable CSS injection into every visited page.
// Yeni stil oluşturcursorStyle = document.createElement('style');cursorStyle.id = 'demonslayer-impact-cursor-style';cursorStyle.textContent = ` * { cursor: url(${data.default_cursor_result}), auto !important; } a, button, input[type="submit"], input[type="button"], .btn, [role="button"], [type="button"], [type="reset"], [type="submit"], [type="checkbox"], [type="radio"], select, option, .clickable, .pointer, [onclick], [data-action], [data-click], [data-toggle] { cursor: url(${data.pointer_cursor_result || data.default_cursor_result}), pointer !important; } `;// Stili sayfaya ekledocument.head.appendChild(cursorStyle);A MutationObserver monitors the entire document tree (`subtree: true`) specifically watching for dynamically injected IFRAME or FRAME elements. While the stated purpose is to re-apply the cursor style, this pattern provides persistent visibility into iframe injection events across all visited pages, which goes beyond what cursor styling requires.
// Sayfadaki dinamik değişiklikleri izle ve cursor'u tekrar uygulaconst observer = new MutationObserver(function(mutations) { // Sadece önemli DOM değişikliklerinde cursor'u tekrar uygula if (mutations.some(mutation => mutation.type === 'childList' && (mutation.addedNodes.length > 0 || mutation.removedNodes.length > 0) && Array.from(mutation.addedNodes) .some(node => node.nodeName === 'IFRAME' || node.nodeName === 'FRAME') )) { if (cursorData) { applyCursor(cursorData); } }});// DOM değişikliklerini izlemeye başlaobserver.observe(document.documentElement, { childList: true, subtree: true});The popup loads a Google Fonts stylesheet via a third-party CDN request each time the popup is opened. This request reveals the user's IP address and timing to Google without explicit disclosure, constituting a minor privacy-leaking tracking call from within the extension popup.
<link href="https://fonts.googleapis.com/css2?family=Nunito:wght@400;600;700&display=swap" rel="stylesheet">By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.01.08 | 5 |
Files with findings
4 distinct paths — top paths by unique finding count:
- cursorcontent.js2
- cursorbackground.js1
- cursorpopup.html1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.