Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Stellar Color Picker

CRITICAL RISKRemoved from Chrome Web Store

Stellar Color Picker

ID: ejndhenjmkhfjcfmjiieeeipealgceho

Could be malicious

Extension Info & Metadata

Status

Removed

Version

2.33

Size

0.43 MB

Rating

0.0/5

Reviews

Users

185,249

Type

Extension

Updated

Nov 11, 2020

Publisher Contextual Analysis

Author: Presley NienowView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

185,249

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Perfectly designed color picker tool for browser tabs

Stellar Color picker is a color picker tool that extracts colors from the pages. Features: ➕ Eyedropper tool: select the “Pick a color” option and you can select a pixel from the active webpage. ➕ Supports keyboard shortcut Alt-P ➕ Displays recently picked colors ➕ Displays the most used color on the page ➕ Output in RGB and HEX HTML-compatible formats

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High1

Medium4

Low1

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.32 Code review	7

Extension Version	Code Review Findings
2.32	7

Files with findings

5 distinct paths — top paths by unique finding count:

background.js3
averageColor.js1
background.html1
inc/cointipper/jquery.cointipper-pack.min.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Unauthorized Data Collection	critical	background.html (line 1)	The background page references `analytics.js` as a local script, but this file is completely absent from the extension bundle (not listed in any directory). A referenced script file that does not exist in the package …	2.32
2	Unauthorized Data Collection	high	background.js (line 239)	Every time the user activates any tab (switches tabs), the extension automatically calls `chrome.tabs.captureVisibleTab()` to take a full PNG screenshot of the visible page, without any user interaction or opt-in. Thi…	2.32
3	Code Injection	medium	inc/cointipper/jquery.cointipper-pack.min.js (line 25)	A full cryptocurrency donation/solicitation library (CoinTipper, supporting Bitcoin, Dogecoin, and Kittehcoin) is bundled into a color picker extension. This library injects donation buttons and modal overlays with QR…	2.32
4	Tracking	medium	background.js (line 173)	The `setColor` function accepts a `url` parameter (the URL of the page where the color was picked, passed from `sender.sender.url` in the port message handler at line 150) but the parameter goes unused in this version…	2.32
5	Unauthorized Data Collection	medium	averageColor.js (line 136)	This content script, injected on every URL (`<all_urls>`), immediately requests a screenshot from the background page upon injection (`get_screenshot` message at line 136), before any user interaction. Combined with t…	2.32
6	Unauthorized Data Collection	medium	background.js (line 239)	This code captures a screenshot of the active tab and forwards the raw image data into a content script, and it does so automatically whenever the user switches tabs. No exfiltration endpoint is present in this versio…	2.32
7	Unauthorized Data Collection	low	manifest.json (line 1)	The extension injects a content script into all pages and also requests host access to all URLs. In isolation this is not malicious, but paired with the screenshot-capture logic it gives the extension visibility into …	2.32

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


github.com	/ssorallen/jquery-scrollstop	https://github.com/ssorallen/jquery-scrollstop
github.com	/jquery/jquery-migrate/blob/master/src/event.js	https://github.com/jquery/jquery-migrate/blob/master/src/event.js#L25
github.com	/jeremymouton/cointipper	https://github.com/jeremymouton/cointipper
www.openjs.com	/scripts/events/keyboard_shortcuts/	http://www.openjs.com/scripts/events/keyboard_shortcuts/
nicolasgallagher.com	/micro-clearfix-hack/	http://nicolasgallagher.com/micro-clearfix-hack/
code.google.com	/p/chromium/issues/detail	https://code.google.com/p/chromium/issues/detail?id=506893
cssfontstack.com	-	http://cssfontstack.com
github.com	/suitcss/components-flex-embed	https://github.com/suitcss/components-flex-embed
snook.ca	/archives/html_and_css/hiding-content-for-accessibility	http://snook.ca/archives/html_and_css/hiding-content-for-accessibility
getbootstrap.com	-	https://getbootstrap.com/

Showing 1 to 10 of 80 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Stellar Color Picker

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating