Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Save to Google Photos™

CRITICAL RISKRemoved from Chrome Web Store

Save to Google Photos™

ID: aoanickgmocpddnppajakfcafbkncdab

Could be malicious

Extension Info & Metadata

Status

Removed

Version

10.8.8

Size

0.21 MB

Rating

4.2/5

Reviews

1,730

Users

204,658

Type

Extension

Updated

May 30, 2020

Publisher Contextual Analysis

Author: http://savetogooglephotos.comView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

204,658

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Upload images to Google Photos

Upload images to Google Photos. Instructions: 1) Open the options menu by clicking on the extension icon. 2) Select an album(s) you want to save too. 3) Right click an image and send it to Google Photos. This extension is not affiliated with Google Photos or Google Photos Team. Please visit https://photos.google.com for Google Photos. Google Photos and the related logo are trademarks of Google LLC. Use of these trademarks are subject to Google Permissions. This extension is free to use with a limit that fits most people's needs. For advance users, an optional $0.99/mo subscription allows unlimited access with a free month trial. You can cancel anytime to go back to the free version. Website & Updates & Private Policy http://foundationalcode.com/index.php/2019/08/08/save-to-google-photos/

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High3

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
10.8.8 Code review	6

Extension Version	Code Review Findings
10.8.8	6

Files with findings

4 distinct paths — top paths by unique finding count:

assets/js/background.js2
assets/js/chromeApi.js2
assets/js/buy.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	manifest.json (line 53)	The manifest Content Security Policy explicitly whitelists `https://storage.googleapis.com` (the origin of the dynamically injected external script) and also permits `'unsafe-eval'`, which allows arbitrary code execut…	10.8.8
2	Remote Code Loading	critical	assets/js/background.js (line 1)	The background script immediately and silently injects a remote JavaScript file from `storage.googleapis.com/stgp/digitaldiscovered_stgp.js` via dynamic `<script>` tag injection. The file is hosted under a GCS bucket …	10.8.8
3	Code Injection	high	assets/js/buy.js (line 1)	`buy.js` uses `b.execScript("var " + c[0])` to dynamically execute a string as code via IE's legacy `execScript` API (functionally equivalent to `eval`). While used here to create global namespace paths, this pattern …	10.8.8
4	Unauthorized Data Collection	high	assets/js/chromeApi.js (line 1)	`chrome.identity.getProfileUserInfo` retrieves the signed-in Google account's email address and stable obfuscated ID without requiring explicit user interaction. This data is collected and returned as the user's "ID" …	10.8.8
5	Unauthorized Data Collection	high	assets/js/background.js (line 1)	On first install, the extension immediately prompts for a Google OAuth token (`interactive: true`) before the user has consented to or even seen any permissions dialog beyond install. It then opens the developer's ext…	10.8.8
6	Tracking	medium	assets/js/chromeApi.js (line 60)	Two suspicious behaviors: (1) The extension opens a third-party promotional site (`chromeway.com`) that is unrelated to its stated Google Photos functionality — this is likely an affiliate or advertising redirect. (2)…	10.8.8

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


bit.ly	/raven-secret-key	http://bit.ly/raven-secret-key
g.co	/ng/security	http://g.co/ng/security#xss
sentry.io	/153083	https://[email protected]/153083
angular.io	/docs/ts/latest/api/common/index/NgFor-directive.html	https://angular.io/docs/ts/latest/api/common/index/NgFor-directive.html#!#change-propagation
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
www.w3.org	/2000/xmlns/	http://www.w3.org/2000/xmlns/
material.angular.io	/guide/theming	https://material.angular.io/guide/theming

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

ya se pago pero continua laborando y es 5 dolares lo que page o regresan el dinero o paran esa "falla" gracias Hello its already paid but keep working and it's 5 dollars what I pay Either they return the money or they stop that "failure" Thank you

Chispitas De Sabiduria·2 Sept 2020

I don't like the shady paywall. Come on.

Ryley·24 Jul 2020

Used to work for me, just spinning now - https://i.imgur.com/BrlT3BG.png

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Save to Google Photos™

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews