Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Tlink

CRITICAL RISKRemoved from Chrome Web Store

Tlink

ID: eblnpllcmmepkmpaalggpibindkplcjj

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

0.7.0

Size

1.71 MB

Rating

4.7/5

Reviews

Users

5,000

Type

Extension

Updated

Nov 28, 2024

Publisher Contextual Analysis

Author: Smart Token LabsView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

5,000

Email Change History

1 change

Oct 22, 2024

Domain changed

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Experience Web3 on Twitter, Telegram and Farcaster.

A secure and fun way to discover new rewards, opportunities and communities on your social feed. ✓ Transforms your Feed into a rich interactive Web3. A completely re-imagined Crypto Twitter experience. ✓ Available for L1 or L2 chains: Ethereum, Base, Polygon, Arbitrum, Optimism, Avalanche, SUI, Tron, BSC, kaia, Blast, Mantle, Aptos and more. ✓ Private and secure: No personal data collected, no assets at risk. USE CASES • Share-to-Earn: Get rewarded for engaging content • Smart Contract Integration: Trigger actions directly from tweets • Governance: Delegate voting • Trading: Buy & sell tokens seamlessly • Community Rewards: Join incentivized promotions And much more: Unlimited possibilities with Tapps. REQUIREMENTS 1. A Chromium-Based Browser. For example Brave, Chrome, Mises, Arc. 2. A Web3 Wallet Compatible with EVM chains. For example, Rabby, Metamask or Phantom. 3. Use on Desktop for best experience. Can be used via Mobile Browser. PRIVACY & SECURITY ✓ No personal information collected. ✓ No access or control over your Web3 funds. ✓ T-Link requests permission to read and change your Twitter data, which it needs for you to use and play with a Tapp on your social feed. DISCLAIMER — When you interact with a Tapp, you are interacting with a Smart Contract. — ALWAYS VERIFY WHAT YOU ARE SIGNING. COMMUNITY ✓ We release regular updates, rewards and promotions. ✓ Join us on Discord https://discord.com/smartlayer ✓ Follow us on Twitter https://twitter.com/SmartLayer DEVELOPERS ✓ Chat with our core developers, join Tapp Ninjas: https://discord.gg/QkvrQC8pAf

User Growth

Showing data from Sep 12, 2024 to May 29, 2025

Versions

-37.5%(-3,000 users)

Compared to 3 months ago

19 versions released in this period

Rating Count

Total: 34 ratings

Average Rating

Current: 4.68 / 5.0+4.68

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High4

Medium0

Low0

Versions scanned

Showing 1 of 19 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.5.0 Code review	7

Extension Version	Code Review Findings
0.5.0	7

Files with findings

5 distinct paths — top paths by unique finding count:

content-scripts/twitter-observer.js3
background.js1
content-scripts/rpc-proxy.js1
manifest.json1
sandbox.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	background.js (line 32)	The background service worker injects a function into the MAIN world of the active tab, grabs `window.tlink \|\| window.ethereum`, and executes arbitrary wallet RPC methods (`eth_sendTransaction`, `eth_requestAccounts`,…	0.5.0
2	Network Interception	critical	content-scripts/rpc-proxy.js (line 25)	The rpc-proxy content script listens for all window messages on twitter.com/x.com and will make fetch POST requests to any URL provided in `s.url` — with zero origin validation or URL allowlisting. Because content scr…	0.5.0
3	Privilege Escalation	critical	manifest.json (line 45)	The manifest declares a MAIN-world content script (`content-scripts/wallet.js`) injected into Twitter, X.com, OpenSea, and Coinbase Wallet — but this file is entirely absent from the extension bundle and could not be …	0.5.0
4	Credential Theft	high	content-scripts/twitter-observer.js (line 15433)	The twitter-observer content script wires all Ethereum wallet operations (transaction signing, account connection, account retrieval) through `chrome.runtime.sendMessage`, routing them to the background service worker…	0.5.0
5	Remote Code Loading	high	sandbox.html (line 45)	The sandbox extension page reads an arbitrary URL from the `url` query parameter and sets it as the source of an embedded iframe — there is no allowlist or origin validation. It then bidirectionally proxies all postMe…	0.5.0
6	Remote Code Loading	high	content-scripts/twitter-observer.js (line 13425)	The extension fetches its trust allowlist from a remote Vercel-hosted endpoint (`tlink-registry.vercel.app`) every 10 minutes and uses the result to classify URLs as `trusted`, `unknown`, or `malicious`. If this endpo…	0.5.0
7	Unauthorized Data Collection	high	content-scripts/twitter-observer.js (line 11648)	A hardcoded HS256-signed JWT (`x-stl-key`) is embedded directly in extension source and is transmitted to `api.smarttokenlabs.com` on every token-view API call. Because the token is shared across all installations, it…	0.5.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

132

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
twitter.com	/*	https://twitter.com/*
x.com	/*	https://x.com/*
pro.x.com	/*	https://pro.x.com/*
viewer.tokenscript.org	-	https://viewer.tokenscript.org/
viewer-staging.tokenscript.org	-	https://viewer-staging.tokenscript.org/
localhost	/;	http://localhost:3333/;
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace

Showing 1 to 10 of 140 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-

3.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

HEY HEY SCAMLAYER

tifa Bae123·7 Nov 2024

SCAMMER COIN

Rama Aaaa·7 Nov 2024

SCAMLAYER, SHIT

Suuryaa 34·7 Nov 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Tlink

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Email Change History

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 19 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating