Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: ThinkVantage Password Manager

CRITICAL RISKRemoved from Chrome Web Store

ThinkVantage Password Manager

ID: lpdfbkehegfmedglgemnhbnpmfmioggj

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

4.60.3

Size

0.03 MB

Rating

3.3/5

Reviews

100

Users

169,457

Type

Extension

Updated

Jul 8, 2014

Publisher Contextual Analysis

Author: lenovocdlappView Profile

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

169,457

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

An extension to support Lenovo's ThinkVantage Password Manager in Google Chrome!

NOTE: You must download and install the latest version of the Password Manager application (v4.60 or later) from the Lenovo Web site to use this extension. Lenovo's ThinkVantage Password Manager makes logging on to your favorite Web sites quicker and easier! Password Manager helps ease the burden of keeping track of your user IDs and passwords by securely storing them on your computer and automatically filling them in for you when it’s time to log in. Lenovo's ThinkVantage Password Manager works better than the password manager built into Chrome because you can use it to fill in passwords in other browsers, and it also supports using the fingerprint reader built into your Lenovo computer for additional convenience and security. The ThinkVantage Password Manager application includes a full UI for managing your stored passwords. You must download and install the latest ThinkVantage Password Manager application from the Lenovo Support Web site to use this Chrome extension (v4.60 or later required).

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High5

Medium1

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
4.60.3 Code review	10

Extension Version	Code Review Findings
4.60.3	10

Files with findings

2 distinct paths — top paths by unique finding count:

pwmgr.js6
background.js4

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	pwmgr.js (line 211)	On every form submission across ALL websites (matched by http:/// and https:///), the content script captures all password field names/values and text field names/values (usernames, emails), then transmits them vi…	4.60.3
2	Credential Theft	critical	pwmgr.js (line 39)	This function systematically scrapes all password fields (and text fields whose name/id contains 'pass' or 'pw') from every form on every page the extension runs on. It captures both field names and plaintext values i…	4.60.3
3	Credential Theft	critical	pwmgr.js (line 274)	The extension hooks both the 'submit' event (with capture=true, intercepting before handlers) and 'click' events globally on every page. Using capture phase for submit ensures credentials are read before the form may …	4.60.3
4	Data Exfiltration	high	background.js (line 104)	The background page establishes a persistent native messaging channel to the host 'com.lenovo.pwdmgr' on the user's machine. All harvested credentials (passwords and text field values from every website visited) are f…	4.60.3
5	Data Exfiltration	high	background.js (line 152)	The full plaintext credential package — site URL, form field names, and all password/text values — is transmitted verbatim to the native host in a single message. There is no encryption, hashing, or scoping to specifi…	4.60.3
6	Data Exfiltration	high	background.js (line 146)	The background page forwards captured credential fields and page metadata to another process via `port.postMessage`. Because the destination is a native messaging host, this moves secrets outside the browser sandbox a…	4.60.3
7	Privilege Escalation	high	background.js (line 104)	This code opens a Native Messaging channel to `com.lenovo.pwdmgr`, allowing the extension to exchange data with a locally installed native application. Native hosts run with user-level OS access, so this materially ex…	4.60.3
8	Unauthorized Data Collection	high	pwmgr.js (line 82)	Beyond passwords, the extension also harvests all text and email input fields from every form on every site visited (excluding only 'verifycode' fields). This means usernames, email addresses, and other form data acro…	4.60.3
9	Unauthorized Data Collection	medium	pwmgr.js (line 178)	Whenever a page contains a password field, the script sends the current URL and title to the background page to fetch matching stored credentials, then injects returned usernames/passwords into the DOM. This is broad …	4.60.3
10	Obfuscation	low	pwmgr.js (line 272)	Passing a string to setTimeout is equivalent to eval() — it forces script engine string evaluation. While the string here is benign, this deprecated pattern is a code quality red flag and historically used as a vector…	4.60.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	http:///
*	/*	https:///

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Erkennt auf W530 nicht den Fingerprint-Scanner.Sonst tut es was es soll.

Norbert Esch·5 Feb 2020

norm

Mar Sel·24 Jan 2018

too many pop ups

Ada Chioma·28 Nov 2017

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

ThinkVantage Password Manager

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews