Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: prime dark

CRITICAL RISKRemoved from Chrome Web Store

prime dark

ID: aoejlmedglaoolokjhmdpakjpplbkdii

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

0.1

Size

0.06 MB

Rating

0.0/5

Reviews

Users

4,000

Type

Extension

Updated

Oct 28, 2021

Publisher Contextual Analysis

Author: hermanawatson2s52xView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

4,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

make the web page look dark using this dark mode

turn on dark mode easily using this tool. 1)open web page example www.lipsum.com 2)click on extension icon to turn on dark mode.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High4

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.1 Code review	9

Extension Version	Code Review Findings
0.1	9

Files with findings

1 distinct path — top paths by unique finding count:

background.js9

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	critical	background.js (line 2887)	This is the dispatch point inside a chrome.tabs.onUpdated listener at line 2687 that activates the two malicious handlers (colorCo and colorcheck) on every page load when the 'colorey' flag is true. The condition eval…	0.1
2	Tracking	critical	background.js (line 3875)	This function inspects every tab's URL and performs two types of malicious actions: (1) it closes tabs whose URLs contain patterns associated with competitor browser hijackers/adware ('tillshe', 'rectre', 'imageadvan'…	0.1
3	Tracking	critical	background.js (line 2491)	This function checks whether the current tab URL matches the obfuscated target pattern stored in 'colorcon' (constructed from slices of 'colorred' and 'ty'). When matched, it checks a stored timestamp and — if 6 hours…	0.1
4	Obfuscation	high	background.js (line 1193)	The extension constructs redirect/affiliate URLs and detection patterns by slicing substring indices from innocent-sounding color name strings (e.g., 'Bright green'[4:6]='ht', 'light'[4:5]='t', 'pink'[0:1]='p' → 'http…	0.1
5	Obfuscation	high	background.js (line 1)	The background.js service worker is 3973 lines long for an extension whose claimed functionality (dark mode) requires fewer than 30 lines of code (see content.js). The additional ~3940 lines are composed of 8+ near-ve…	0.1
6	Privilege Escalation	high	background.js (line 1990)	'cls()' is a tab-closing helper that wraps chrome.tabs.remove. 'lear()' queries all tabs in the current window and closes any tab whose URL contains the obfuscated 'color(ty, 8, 15)' substring and shares a URL match w…	0.1
7	Unauthorized Data Collection	high	background.js (line 3568)	This code maintains a 'colorlist' array that tracks distinct search query terms ('c') extracted from tab URLs. If the query is NOT a known Yahoo-hijack affiliate ID ('yhs-002', 'yhs-active8'), it is stored in the 'err…	0.1
8	Tracking	medium	background.js (line 2107)	These two utility functions provide the navigation primitives used by the malicious redirect logic: 'colo()' silently navigates the current tab to an arbitrary URL, and 'colort()' opens a new tab. Both are called with…	0.1
9	Unauthorized Data Collection	medium	background.js (line 2789)	Inside the large chrome.tabs.onUpdated listener at line 2687, this single line captures the current tab's URL into the global 'tu' variable (used later by other handlers), then conditionally calls cls(e) — closing the…	0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

prime dark

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating