Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Summer cursors

CRITICAL RISKRemoved from Chrome Web Store

Summer cursors

ID: ehccelcgobpdfpigninocncepcpieidg

Could be malicious

Extension Info & Metadata

Status

Removed

Version

3.9.1

Size

3.26 MB

Rating

4.8/5

Reviews

Users

215,689

Type

Extension

Updated

Oct 27, 2020

Publisher Contextual Analysis

Author: Yessenia StromanView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

215,689

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Stylish and light cursors inspired by summer season

Summer Cursors replaces default mouse cursors on web pages. We have a huge collection of cursors, so you can find your personal style. Features: * Preselected collection of hundreds of cursors (See screenshot!) * Replace cursor with your own cursor (128x128 images) Note: Summer Cursors changes cursor only over web page content. It won’t work if the mouse cursor is over the browser user interface.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High2

Medium1

Low2

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.9.1 Code review	2
3.9 Code review	5

Extension Version	Code Review Findings
3.9.1	2
3.9	5

Files with findings

3 distinct paths — top paths by unique finding count:

background.js5
popup.html1
settings.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Remote Code Loading	critical	background.js (line 168)	This code dynamically constructs and injects a remote Google Tag Manager script URL into the extension background page. Combined with the manifest CSP allowing `https://www.googletagmanager.com`, it gives the publishe…	3.9.1
2	Unauthorized Data Collection	critical	background.js (line 163)	The extension registers a completely unrestricted `chrome.runtime.onMessageExternal` listener with no origin validation. Any external website can call `chrome.runtime.sendMessage(extensionId, {action: 'get_config'})` …	3.9
3	Code Injection	high	background.js (line 171)	Via the unrestricted external messaging API, any website can invoke `install_collection` or `install_pack` to inject arbitrary cursor entries into the extension's collection stored in local storage. Since cursor paths…	3.9
4	Privilege Escalation	high	background.js (line 187)	The extension exposes an external messaging API that reads all local/sync configuration and allows arbitrary writes to privileged extension storage, but it performs no sender validation at all. Any other extension tha…	3.9.1
5	Tracking	medium	background.js (line 238)	The `authSync` method runs every 10 seconds throughout the browser session, continuously overwriting local storage with the hardcoded `listOfCollection` and pushing the full list of installed pack IDs to `chrome.stora…	3.9
6	Tracking	low	popup.html (line 7)	The popup UI loads fonts from `fonts.googleapis.com`, an external third-party CDN. Every time the user opens the extension popup, their IP address and browser fingerprint (User-Agent, Referer) are transmitted to Googl…	3.9
7	Tracking	low	settings.html (line 6)	Same pattern as popup.html — the settings page makes two outbound requests to `fonts.googleapis.com` on every open, leaking the user's IP and User-Agent to Google. Loading Material Icons from an external CDN rather th…	3.9

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.opensource.org	/licenses/mit-license.php	http://www.opensource.org/licenses/mit-license.php
appelsiini.net	/projects/lazyload	https://appelsiini.net/projects/lazyload
jquery.com	-	http://jquery.com/
sizzlejs.com	-	http://sizzlejs.com/
jquery.org	/license	http://jquery.org/license
jsperf.com	/thor-indexof-vs-for/5	http://jsperf.com/thor-indexof-vs-for/5
www.w3.org	/TR/css3-selectors/	http://www.w3.org/TR/css3-selectors/#whitespace
www.w3.org	/TR/CSS21/syndata.html	http://www.w3.org/TR/CSS21/syndata.html#value-def-identifier
www.w3.org	/TR/selectors/	http://www.w3.org/TR/selectors/#attribute-selectors
www.w3.org	/TR/CSS21/syndata.html	http://www.w3.org/TR/CSS21/syndata.html#escaped-characters

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

The extension helps with my work.

slava kirilov·15 Nov 2020

The extension is noteworthy, a very interesting set of cursors, you can choose for every taste.

Nikita Shubin·15 Nov 2020

Very useful app.I advise everyone.

Maks Smirnov·14 Nov 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Summer cursors

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews