SangerboxNote

ID: hblcedloibomgfngblmmmaoddadbdonj

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Active

Version

1.1.3

Size

0.10 MB

Rating

4.9/5

Reviews

Users

10,000

Type

Extension

Updated

Nov 15, 2022

Publisher Contextual Analysis

Author: shenwt1234View Profile
Privacy: Privacy Policy
Help: Help Center

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

使用桑格笔记，获取更多期刊信息

PubMed阅读伴侣，科研文献整理助手高效，快速，全面阅读体验，安装浏览器插件即可使用 ☞影响因子、预测影响因子、分区等信息快速获取 ☞杂志精确检索、文献自定义排序、sci-hub全文链接 ☞文献收藏、整理及备注功能

User Growth

Showing data from Mar 22, 2022 to Mar 21, 2023

Versions

No change in user count

Compared to 3 months ago

7 versions released in this period

Rating Count

Total: 4 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High5

Medium3

Low0

Versions scanned

Showing 1 of 7 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.7 Code review	8

Extension Version	Code Review Findings
1.0.7	8

Files with findings

3 distinct paths — top paths by unique finding count:

js/ncbi.min.js4
js/background.min.js3
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	high	js/background.min.js (line 1)	Background uses the chrome.cookies API to read the 'authorization' session cookie (and 'uname') from note.sangerbox.com and hands it to the NCBI-page content script, which writes it to localStorage('authorization_sang…	1.0.7
2	Privilege Escalation	high	manifest.json (line 19)	The extension declares all-URLs host permissions (http:/// and https:///) granting the service worker the ability to read cookies and issue authenticated fetches to any site, even though the extension's stated fun…	1.0.7
3	Remote Code Loading	high	js/ncbi.min.js (line 1)	The content script fetches a string ('newVersion') from shengxin.ren and interpolates it into HTML that is then parsed via createContextualFragment and inserted into the NCBI DOM. Because the value is fully attacker-c…	1.0.7
4	Tracking	high	js/background.min.js (line 1)	Background service worker forwards article-view telemetry (title, pmid, journal, URL) to an off-store server (shengxin.ren) with credentials included. Combined with the content script that triggers it on every article…	1.0.7
5	Unauthorized Data Collection	high	js/ncbi.min.js (line 1)	Every PubMed article a user views (full title, PMID, journal name, and complete URL) is silently exfiltrated to the third-party endpoint shengxin.ren/note/saveHistory along with an auth token. This is unauthorized col…	1.0.7
6	Code Injection	medium	js/ncbi.min.js (line 1)	Content script injects HTML containing inline event handler attributes (oninput="...") into a third-party page via createContextualFragment. While this string is hard-coded today, the use of inline JS via DOM-parsed f…	1.0.7
7	Credential Theft	medium	js/ncbi.min.js (line 1)	Content script pulls the sangerbox.com authorization cookie out of the background page and persists it into localStorage on the ncbi.nlm.nih.gov origin, where it is exposed to any script running on that page (includin…	1.0.7
8	Other	medium	js/background.min.js (line 1)	The extension queries shengxin.ren/note/getSciHubUrl for a list of Sci-Hub mirror URLs and, in details_init, injects 'SCI-HUB LINKS' anchor tags into PubMed article pages so users can fetch pirated PDFs of paywalled D…	1.0.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fontawesome.io	-	http://fontawesome.io
fontawesome.io	/license	http://fontawesome.io/license
www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
pubmed.ncbi.nlm.nih.gov	-	https://pubmed.ncbi.nlm.nih.gov/?term=

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

试了好几个插件，这是唯一一个工作的。但是sci全文pdf链接目前点进去没有用。

Yi Zhu·23 Dec 2024

非常好用，赶紧更新最新的分区吧

EE DD·18 Feb 2024

非常好用的插件，如果能更新一下2022的影响因子就更好了

LITTLE photo·30 Jun 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

SangerboxNote

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 7 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating