Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Split Plus

CRITICAL RISKRemoved from Chrome Web Store

Split Plus

ID: nnkpcgoehnkepajpeicacjahlpiopnnf

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

2.4.3

Size

0.67 MB

Rating

3.7/5

Reviews

Users

400,000

Type

Extension

Updated

Aug 11, 2021

Publisher Contextual Analysis

Author: Kamal GhimireView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

400,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Easily split browser windows into smart layouts

Split Plus splits currently opened tabs and arranges them into separate windows. == FEATURES == * Split to 1x1 1x2 2x1 2x2 layouts * Uses separate windows (not HTML frames) * Shortcuts (Ctrl Shift 1, Ctrl Shift 2, Ctrl Shift 4, Ctrl Shift Z) How to use the extension: * Find the puzzle icon in the toolbar, open a menu * Find the “Split Plus” icon in the menu. Pin it to the toolbar * Try one of the options. You can always undo the operation

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High2

Medium3

Low0

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.4.2 Code review	2
2.4.1 Code review	4

Extension Version	Code Review Findings
2.4.2	2
2.4.1	4

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.js4
manifest.json2

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	js/background.js (line 11537)	This code dynamically loads `analytics.js` from Google's servers into the extension background page. Remote script loading is a serious security risk for extensions because the remotely controlled code executes outsid…	2.4.2
2	Remote Code Loading	high	manifest.json (line 17)	The extension injects a content script into every visited page and also requests `tabs` plus broad host access. More importantly, the CSP explicitly whitelists `https://www.google-analytics.com` for script execution, …	2.4.2
3	Remote Code Loading	high	js/background.js (line 4)	The background page dynamically injects analytics.js from an external Google Analytics CDN at runtime via DOM manipulation, rather than bundling it locally. More critically, it calls `ga("set","checkProtocolTask",null…	2.4.1
4	Code Injection	medium	js/background.js (line 6)	On install or update, `executeContent()` programmatically injects `content.js` into every open tab (`chrome.tabs.query({})` with no filter) via `chrome.tabs.executeScript`. Although gated behind the `onpage_control` s…	2.4.1
5	Remote Code Loading	medium	manifest.json (line 1)	The manifest's Content Security Policy explicitly whitelists `https://www.google-analytics.com` as a trusted script source, which is required to allow the dynamic injection of `analytics.js` in the background page. Th…	2.4.1
6	Tracking	medium	js/background.js (line 4)	The extension sends a pageview beacon to Google Analytics tracking ID `UA-195694794-1` from the persistent background page on every browser session. Setting `checkProtocolTask` to null is an explicit bypass of GA's pr…	2.4.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
www.google-analytics.com	/analytics.js	https://www.google-analytics.com/analytics.js
usemarketngs.com	-	https://usemarketngs.com
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.google-analytics.com;	-	https://www.google-analytics.com;

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

it doesn't work at all!

Andres Castaneda·14 Sept 2021

Doesn't do anything apart from add a fancy non functional button...

Simon Fisher·7 Sept 2021

I downloaded the extensions, installed them without lags and very quickly. The developers are well done, I recommend it.

Dmitry Chekmenev·1 Sept 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Split Plus

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews