Security Alert: Confirmed Malware
TimeNow
ID: afilbkkbagloanfddkgnbeamaoekando
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Playdigo IncView Profile
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- 16192 Coastal Highway Lewes, DE 19958 US
- Website
- Visit
Allowing users to easily track the current time across different regions of the world.
Time Now is a free new tab extension that allows you to view time zones in multiple places around the world instantly. With a user-friendly interface, this extension provides you with the current time and date in various cities, making it easy to stay connected across different time zones. It also includes a customizable web search bar, for convenient internet searches. By clicking "Add to Chrome", I accept and agree to install TimeNow Chrome extension and setting Chrome New Tab search provider to Microsoft Bing as described by the service in the Terms of Use - http://timenow.world/terms-and-conditions/ and Privacy Policy - http://timenow.world/privacy-policy/ You can find more about us here: http://timenow.world/about-us/
Combined with the manifest's `chrome_url_overrides.newtab` directive, the extension hijacks the user's new-tab page and forces every search submitted there to be redirected to Bing via `window.location.replace`. This is a classic search/new-tab hijacker pattern used to monetize traffic through search-affiliate revenue, bypassing the user's chosen default search engine without disclosure in the listing.
function search() { const searchTermEncoded = encodeURIComponent(searchInputValue.trim()); if (searchTermEncoded) { window.location.replace(`https://www.bing.com/search?q=${searchTermEncoded}`); }}function handleEnterKey(event) { if (event.key === "Enter") { event.preventDefault(); search(); }}function handleSearchButtonClick() { search();}input.addEventListener("keyup", (event) => { searchInputValue = event.target.value; handleEnterKey(event);});submit.addEventListener("click", handleSearchButtonClick);The extension declares itself as a world-time tracker but uses `chrome_url_overrides.newtab` to seize control of every new tab the user opens. This new-tab takeover is then weaponized by the popup.js search handler to funnel queries to Bing, a behavior not disclosed in the extension's name or description.
{ "update_url": "https://clients2.google.com/service/update2/crx", "manifest_version": 3, "name": "TimeNow", "description": "Allowing users to easily track the current time across different regions of the world.", "version": "1.3", "chrome_url_overrides": { "newtab": "index.html" }, "host_permissions": [ "https://worldtimeapi.org/" ], "action": { "default_icon": "images/logo.png" }}By severity
Versions scanned
Showing 1 of 9 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.3 | 2 |
Files with findings
2 distinct paths — top paths by unique finding count:
- manifest.json1
- popup.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.