Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Rakuten Button Canada

CRITICAL RISKRemoved from Chrome Web Store

Rakuten Button Canada

ID: idpbkophnbfijcnlffdmmppgnncgappc

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

7.12.1

Size

2.07 MB

Rating

4.7/5

Reviews

597

Users

300,000

Type

Extension

Updated

Oct 19, 2024

Publisher Contextual Analysis

Trusted

Author: https://www.rakuten.caView Profile
Privacy: Privacy Policy
Help: Help Center
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 800 Concar Drive 5th Floor San Mateo, CA 94402 US
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

300,000

Rakuten Button Canada provides automatic Cash Back alerts at participating stores. No hassle. No more missed Cash Back!

Always forgetting Cash Back? Let us help. Shop like you normally would at your favourite stores and we’ll alert you when Cash Back is available. Trust us, you’ll never forget Cash Back again! Rakuten (formerly Ebates) Button provides automatic Cash Back alerts at participating stores. It’s the must-have browser extension that saves you money. 5 FEATURES & BENEFITS: 1) CASH BACK IN ONE CLICK Head straight to the site you want to shop (instead of Rakuten.ca) and activate Cash Back in one click. 2) COUPON MAGIC We’ll auto-apply the best promo codes on the web to ensure you’re getting the best bang for your buck. 3) BONUS CASH BACK EVENTS Access weekly Bonus Cash Back offers and top stores to save even more. 4) SEE CASH BACK OFFERS WHILE YOU SEARCH Compare Cash Back rates on the search results pages of Google, Yahoo and Bing. 5) QUICK ACCESS Easily monitor your account information and shopping activity in one glance. Please see our Privacy Policy at http://www.rakuten.ca/help/privacy-policy When you use Rakuten, merchants may pay us affiliate commissions. We share those commissions with our users.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 4 months ago

3 versions released in this period

Rating Count

Total: 595 ratings+1 (0%)

Average Rating

Current: 4.69 / 5.0-0.00

Item	Type	Severity	Description
webRequest	Permission	Critical	This permission enables the extension to monitor and analyze all web requests made by the browser. Rated Critical because it can observe all network traffic including sensitive data, track browsing behavior, and gather authentication tokens.
<all_urls>	Host	Critical	Broad host access — the extension can read/modify content on every website.
cookies	Permission	High	This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
webNavigation	Permission	High	This permission enables monitoring of all browser navigation events and transitions. Rated High because it can track every page visit, navigation method, and browsing pattern, potentially exposing sensitive browsing behavior and user activities.
Contextual Risk Factors	Risk Factor	High	The following context increases the overall risk:• 10% increase: Early script execution enables pre-emptive content manipulation
Broad Host Permissions	Risk Factor	High	This extension has broad host permissions allowing it to access many or all websites.
tabs	Permission	Medium	This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
storage	Permission	Medium	This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
Early Content Script Execution	Risk Factor	Medium	This extension runs content scripts at document_start.
alarms	Permission	Low	This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

By severity

Critical3

High6

Medium6

Low1

Versions scanned

Showing 2 of 9 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
7.11.0 Code review	6
7.9.1 Code review	10

Extension Version	Code Review Findings
7.11.0	6
7.9.1	10

Files with findings

2 distinct paths — top paths by unique finding count:

bg/bundle.js12
content/bundle.js4

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	bg/bundle.js (line 17263)	This handler takes captured order-page HTML and sends it off-box together with merchant identifiers, shopping trip ID, URL, and client metadata. Uploading raw order-confirmation HTML to `capture.ecbsn.com` is a concre…	7.11.0
2	Privilege Escalation	critical	bg/bundle.js (line 1)	A message handler contains a branch (`ALLTABS`) that calls `chrome.windows.getAll({populate:true})` and then iterates over every open tab across all windows, updating each one to a new URL. If the background script re…	7.9.1
3	Unauthorized Data Collection	critical	bg/bundle.js (line 1)	The `sn(domain, cookieName)` function uses `chrome.cookies.getAll({domain: t})` with a caller-supplied domain argument, meaning it can harvest all cookies for any arbitrary domain — not just Rakuten's own. When `e` is…	7.9.1
4	Credential Theft	high	bg/bundle.js (line 1)	The user's Rakuten session token (`usertoken`) is injected as a `token` HTTP header into every outbound sync request made by the background page. The token is also exposed on the global `window.CBSP` object, making it…	7.9.1
5	Network Interception	high	bg/bundle.js (line 1)	The Datadog RUM SDK permanently monkey-patches both `XMLHttpRequest.prototype.open` and `XMLHttpRequest.prototype.send` in the background page, intercepting every XHR call made by the extension and capturing method, U…	7.9.1
6	Tracking	high	bg/bundle.js (line 16098)	After collecting extension-presence results, the background script stores them and sends a telemetry event named `Competitor Applications`. This is direct reporting of the user's installed extension set to a remote an…	7.11.0
7	Tracking	high	bg/bundle.js (line 1)	When the user's Rakuten `memberGuid` is resolved, it is immediately used to call `pe.identify(memberGuid, {})` on a Segment analytics client (`pe`) that batches events to `https://api.segment.io/v1/batch`. The client …	7.9.1
8	Unauthorized Data Collection	high	content/bundle.js (line 847)	This code probes `chrome-extension://` URLs to determine whether other extensions are installed. Using extension resource fetches for presence detection is a classic extension fingerprinting technique and is unrelated…	7.11.0
9	Unauthorized Data Collection	high	content/bundle.js (line 3626)	On recognized order-confirmation pages, the content script grabs the full page HTML and forwards it to the background script. Full checkout/order-confirmation DOMs can contain names, addresses, order contents, totals,…	7.11.0
10	Network Interception	medium	bg/bundle.js (line 12070)	The background page continuously monitors tab activation, focus changes, tab updates, and URL transitions across all browsing sessions. Combined with `<all_urls>`, `tabs`, `webNavigation`, and `webRequest`, this provi…	7.11.0
11	Tracking	medium	bg/bundle.js (line 16533)	The uninstall URL is dynamically populated with the list of detected installed extensions via the `%ext%` query parameter. That means the extension transmits extension-fingerprint data during uninstall, which is unnec…	7.11.0
12	Tracking	medium	bg/bundle.js (line 1)	The background page sends events directly to Google Analytics (`https://www.google-analytics.com/collect`) including `navigator.language`, screen dimensions, and custom dimension `cd1` set to the user's Rakuten member…	7.9.1
13	Tracking	medium	content/bundle.js (line 1)	The content script actively detects when the user is on a competing cashback/coupon extension's site (tagged as `competitor_domain` and `competitor_session: true`) and reports this information back to Rakuten's server…	7.9.1
14	Unauthorized Data Collection	medium	bg/bundle.js (line 1)	The background page registers a `webRequest.onBeforeRequest` listener on `<all_urls>` for `main_frame` requests, capturing every top-level URL the user navigates to. Simultaneously, `tabs.onUpdated` records every URL …	7.9.1
15	Unauthorized Data Collection	medium	content/bundle.js (line 1)	The content script (injected at `document_start` on all URLs) reads `document.cookie` and parses all page cookies to extract the `express_locale` value. Running at `document_start` means the script executes before the…	7.9.1
16	Data Exfiltration	low	bg/bundle.js (line 1)	Segment events are batched and POSTed to `https://api.segment.io/v1/batch` with a Base64-encoded `writeKey` as Basic Authentication. The `credentials: 'include'` flag sends browser cookies along with the request. Each…	7.9.1

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.


pictogrammers.com	-	http://pictogrammers.com/
www.apache.org	/licenses/LICENSE-2.0	https://www.apache.org/licenses/LICENSE-2.0
opensource.org	/licenses/MIT	https://opensource.org/licenses/MIT
www.openexchangerates.org	-	https://www.openexchangerates.org
vorb.de	-	http://vorb.de
www.opensource.org	/licenses/mit-license.php	http://www.opensource.org/licenses/mit-license.php
jeditoolkit.com	-	http://jeditoolkit.com
openjsf.org	-	https://openjsf.org/
allyoucanleet.com	-	http://allyoucanleet.com/
dojofoundation.org	-	http://dojofoundation.org/

Showing 1 to 10 of 100 rows

Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

No IP addresses found

3.4 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Does not detect the shopping trips. I have to send them all the documents every time to proof the purchase.

Karén Karapetyan·25 Dec 2024

Great!

Arman Mamazizi·30 Oct 2024

We invite you to join us in our partnership to expand your revenue and grow your chrome extension. Let's explore how we can help you. Learn more at: https://extensionbuysell.com Looking forward to working with you!

Madison Francis·

Version	Size	Is Malicious	Findings	Permhash
7.12.0 Latest	2.07 MB	Malicious	—	04f94fec6e3e18af6e61eae87ac691ffafe969ee26b0419dba2fa6e2e13eb638
7.11.0	2.07 MB	Malicious	6	a031e0a9ca4ebcdf8b559fc9984ad13cc389bebc369aaa59633b850c83167060
7.10.0	2.07 MB	Malicious	—	a031e0a9ca4ebcdf8b559fc9984ad13cc389bebc369aaa59633b850c83167060
7.9.1	4.74 MB	Malicious	10	a031e0a9ca4ebcdf8b559fc9984ad13cc389bebc369aaa59633b850c83167060
7.9.0	4.74 MB	Malicious	—	a031e0a9ca4ebcdf8b559fc9984ad13cc389bebc369aaa59633b850c83167060
7.8.0	4.73 MB	Malicious	—	a031e0a9ca4ebcdf8b559fc9984ad13cc389bebc369aaa59633b850c83167060
7.7.0	4.73 MB	Malicious	—	a031e0a9ca4ebcdf8b559fc9984ad13cc389bebc369aaa59633b850c83167060
7.5.0	2.98 MB	Malicious	—	63bfc43e93616d7dfcea1ee0a267de5f410d9238e6fb41541cbc93d825a14da9
7.12.1	2.07 MB	Malicious	—	04f94fec6e3e18af6e61eae87ac691ffafe969ee26b0419dba2fa6e2e13eb638

Showing 1 to 9 of 10 rows

Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Security Alert: Confirmed Malware

Rakuten Button Canada

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Manifest File Security Analysis

Code Review Findings Summary Across 9 Versions16

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating