Security Alert: Malware Risk Confirmed
Screen Recorder
ID: bgnpgpfjdpmgfdegmmjdbppccdhjhdpe
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- AI Webcam EffectsView Profile
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- 1833 S OCEAN DR 1403 HALLANDALE BEACH, FL 33009 US
- Website
- Visit
Screen recorder - simple, tiny, user-friendly and full-featured!
Free Screen recorder for Windows PC, Mac, Chromebook and Linux ๐ฅOur screen and audio recorder captures screen, webcamera, microphone and system sound, and autosaves recordings to your computer in MP4 format. โญ๏ธKey Features Capture screen in three modes: whole desktop, separate window or chrome tab Record screen with system sound, microphone, both of them or no audio at all. Our Screen recorder extension is free, without watermark, limits and sign ups! Looking for the best screen recorder for PC? Reasons to choose our Screen recorder: ๐ฌ Record unlimited videos โ all free, no sign ups! ๐ Recordings are automatically and instantly saved to your computer in MP4 format. ๐ฅ Record screen with audio from microphone and system sound. ๐ Easy, compact and draggable interface โ it saves your screen space in full screen mode ๐ก๏ธ We respect your privacy โ you always know exactly what sources (video and audio) are being recorded, the extension does not collect or store any of your data. ๐ก How to make a screen recording? 1. Install the extension by clicking the "Add to Chrome" button 2. Open a new browser page or reload the current page 3. Click the extension icon 4. Grant access to your microphone if you want to record your voice 5. Select video and audio sources in the pop-up dialog 6. Record your video 7. Once you click Stop, the recording will be automatically downloaded to your Downloads directory โญ๏ธTop Use cases โธ Record simple tutorial videos: how to use any website or application. โธ Save time when discussing a problem or bug: create steps to reproduce a video that helps the developer understand the context and find the problem. โธ Capture system sound: recording system sound works for Chrome tab option, so you can share your game play with all the details. โธ Eliminate work meetings in favor of more effective, asynchronous communication.
The extension uses declarativeNetRequest to forcibly blank the Content-Security-Policy header on every main frame and sub frame load across all websites. CSP is the primary browser defense against XSS and script injection; stripping it from every page visited removes that protection entirely, allowing injected scripts (including those the extension itself injects via content.js) to run without restriction on banking, email, and other sensitive sites.
[ { "id": 1, "priority": 1, "action": { "type": "modifyHeaders", "responseHeaders": [ { "header": "content-security-policy", "operation": "set", "value": "" } ] }, "condition": { "resourceTypes": [ "main_frame", "sub_frame" ] } }]The content script injects the full app.js bundle as a module script into the <head> of every HTML page matched by <all_urls>, running before any other scripts due to insertBefore(e, t.firstChild). Combined with the CSP-stripping rule in rules.json, this gives the injected script full DOM access and network reach on every site the user visits, without being subject to the host page's own security policy.
class T { static injectScript() { if (document.contentType === "text/html") try { const e = document.createElement("script"); e.setAttribute("type", "module"), e.setAttribute("src", chrome.runtime.getURL("scripts/app.js")), e.async = ! 1; let t = document.head || document.getElementsByTagName("head")[0] || document.documentElement; t.insertBefore(e, t.firstChild) } catch (e) { console.error("[ Content ]:", e) } }}T.injectScript();The extension fetches a JavaScript worker script from `https://unpkg.com/webm-wasm@latest/dist/webm-worker.js` at runtime and executes it as a Web Worker, then also passes a WASM binary URL from the same CDN. The `@latest` version tag is unpinned, meaning the fetched code can change at any point without an extension update โ a compromise of the npm package or the unpkg CDN would result in arbitrary attacker-controlled JavaScript executing inside the extension. This is a classic supply-chain remote code loading vector.
g = !1, fetch("https://unpkg.com/webm-wasm@latest/dist/webm-worker.js") .then(function(U) { U.arrayBuffer() .then(function(c) { T(H, c) }) });...D = new Worker(a.workerPath), D .postMessage(a.webAssemblyPath || "https://unpkg.com/webm-wasm@latest/dist/webm-wasm.wasm"), D .addEventListener("message", function(U) { U.data === "READY" ? (D.postMessage({ width: a.width, height: a.height, bitrate: a.bitrate || 1200, timebaseDen: a.frameRate || 30, realtime: a.realtime })The manifest exposes every extension resource (wildcard `*`) to every origin (`<all_urls>`). This means any web page can fetch or iframe any file inside the extension package, including internal scripts and assets. Combined with the CSP-stripping rule and content script injection, a malicious or compromised third-party page could leverage these exposed resources as injection vectors or fingerprint the extension to target its attack surface.
{ "web_accessible_resources": [ { "resources": [ "*" ], "matches": [ "<all_urls>" ] } ]}By severity
Versions scanned
Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.3 | 4 |
Files with findings
4 distinct paths โ top paths by unique finding count:
- manifest.json1
- rules.json1
- scripts/app.js1
- scripts/content.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.