Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: The Black Cat

CRITICAL RISKRemoved from Chrome Web Store

The Black Cat

ID: eeponaffnjegcgoomdelieeifidneeea

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.1.4

Size

1.34 MB

Rating

2.9/5

Reviews

Users

874,971

Type

Extension

Updated

Oct 4, 2020

Publisher Contextual Analysis

Author: Eleanor SellersView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

874,971

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Cute and well-tested dark themes for websites

The Black Cat (aka TBC) applies dark themes to many websites. Don’t ruin your browsing experience with low-quality dark themes. All themes are tested with the latest changes on websites. ⭐ Huge list of supported websites ⭐ Enable/disable for the specific website ⭐ Yellow tint turns on at night

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium2

Low1

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.4 Code review	2
1.1.3 Code review	5

Extension Version	Code Review Findings
1.1.4	2
1.1.3	5

Files with findings

3 distinct paths — top paths by unique finding count:

manifest.json3
background.js2
inject.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Tracking	critical	background.js (line 67)	This code dynamically injects a remote Google Tag Manager script into the extension background page. That is suspicious because GTM can deliver and update JavaScript remotely, enabling hidden tracking behavior and pot…	1.1.4
2	Privilege Escalation	high	manifest.json (line 17)	inject.js is declared with `all_frames: true` and `match_about_blank: true`, causing it to execute inside every iframe on every page including sandboxed about:blank iframes that host payment forms, login dialogs, and …	1.1.3
3	Remote Code Loading	high	manifest.json (line 11)	The extension explicitly allows remote scripts from `google-analytics.com` and `googletagmanager.com` in its extension CSP while also running a privileged background page. In a Manifest V2 extension, this creates a re…	1.1.4
4	Unauthorized Data Collection	high	manifest.json (line 11)	The extension injects moment.js (a 4,601-line date utility library) as a content script into every page the user visits at document_start, before the DOM is parsed. No other extension file — background.js, inject.js, …	1.1.3
5	Code Injection	medium	inject.js (line 68)	The Relax class programmatically injects a full-viewport div with z-index 2147483647 (the maximum 32-bit signed integer, guaranteeing it sits above all other page content) that extends 120% of the page dimensions. Whi…	1.1.3
6	Code Injection	medium	background.js (line 10)	On installation, the extension immediately queries ALL open browser tabs and programmatically injects inject.js into every matching tab via `chrome.tabs.executeScript`. This means the extension's content code is force…	1.1.3
7	Code Injection	low	inject.js (line 185)	The extension fetches CSS file contents as text and injects them as raw text nodes into the page's DOM via `document.createTextNode(res)` inside a dynamically created `<style>` element. While the fetched URLs are rest…	1.1.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

159

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


chrome.google.com	-	https://chrome.google.com
www.googletagmanager.com	/gtm.js	https://www.googletagmanager.com/gtm.js?id=GTM-MP6PS49&l=${lang}`;
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/master/LICENSE	https://github.com/twbs/bootstrap/blob/master/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
github.com	/liorgrossman/darkness/tree/master/chrome-extension/themes	https://github.com/liorgrossman/darkness/tree/master/chrome-extension/themes
userstyles.org	/styles/126925/bing-dark	https://userstyles.org/styles/126925/bing-dark
colincon.ga	-	http://colincon.ga
userstyles.org	/styles/101431/new-duckduckgo-dark-theme	https://userstyles.org/styles/101431/new-duckduckgo-dark-theme
userstyles.org	/styles/120329/ebay-dark-black-midnight-smacked	https://userstyles.org/styles/120329/ebay-dark-black-midnight-smacked

Showing 1 to 10 of 160 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-
4.4.3.2	IPv4	-

2.9 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

The thing is, It just, well, makes some white things unable to see. As a student, because of Covid, useing googleclassroom some things I can't see. I have to highlight it to see it. But the rest are ok!

Gιɾ��ʅყ��ιƈαʅ·12 Mar 2021

Gιɾʅʅყƚιƈαʅ·12 Mar 2021

I can't change back to light

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

The Black Cat

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating