Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Token signing

CRITICAL RISKRemoved from Chrome Web Store

Token signing

ID: ckjefchnfjhjfedoccjbhjpbncimppeg

Could be malicious

Supported Languages

🇺🇸English

🇪🇪Estonian

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

0.0.33

Size

0.06 MB

Rating

1.8/5

Reviews

824

Users

515,219

Type

Extension

Updated

Aug 15, 2023

Publisher Contextual Analysis

Trusted

Author: riaeeView Profile
Privacy: Privacy Policy
Country: EE
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: Pärnu mnt 139a Tallinn 11317 EE
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

1,415,219

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Use your eID smart card on the web

Active development and management of the Token Signing component have ended due to the transition to the new web authentication and signing solution (Web eID): https://www.id.ee/en/article/the-latest-version-of-the-id-software-includes-an-innovative-web-eid-interface/ Token Signing extension will be removed from the extensions stores on 1st September 2023. Web eID components are included in the ID-software installation package which can be downloaded from the website www.id.ee. NB! Please remove Token Signing extension in order for Web eID to work. For Uninstallation, please follow these instructions https://github.com/open-eid/chrome-token-signing/wiki/Extension-removal.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-15.3%(-93,067 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 818 ratings

Average Rating

Current: 1.84 / 5.0-0.03

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High6

Medium2

Low0

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.32 Code review	4
0.0.30 Code review	4

Extension Version	Code Review Findings
0.0.32	4
0.0.30	4

Files with findings

4 distinct paths — top paths by unique finding count:

content.js4
manifest.json2
background.js1
page.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	content.js (line 49)	The content script dynamically injects a script element containing the full TokenSigning API into the DOM of every web page it loads on (matching :///* and file:///*). This technique bypasses the content script isol…	0.0.30
2	Privilege Escalation	high	manifest.json (line 13)	The extension injects a content script into essentially every web page, every frame, and even local `file://` pages while also holding the `nativeMessaging` permission. That combination creates a broad bridge from arb…	0.0.32
3	Privilege Escalation	high	content.js (line 21)	Any script running in the page can forge a `window.postMessage` payload with `src: "page.js"`; the only validation is `event.source === window`, which does not authenticate the sender. This lets arbitrary page JavaScr…	0.0.32
4	Privilege Escalation	high	background.js (line 134)	The background page explicitly documents that URL allowlisting is not implemented and forwards requests anyway. Combined with the broad content-script injection, this means any visited site can access the native messa…	0.0.32
5	Privilege Escalation	high	page.js (line 63)	All outbound signing and certificate requests are dispatched via postMessage with a wildcard ('*') target origin rather than being restricted to the current document's origin. A malicious iframe embedded in the same p…	0.0.30
6	Unauthorized Data Collection	high	content.js (line 43)	The content script broadcasts all extension messages — including cryptographic certificates and digital signatures from the user's eID smart card — back to the page using a wildcard target origin ('*'). Any cross-orig…	0.0.30
7	Code Injection	medium	content.js (line 143)	The content script injects executable inline JavaScript into every matched page by writing to `innerHTML`. This is a deliberate code-injection bridge from the extension into page context; while sometimes used for API …	0.0.32
8	Unauthorized Data Collection	medium	manifest.json (line 13)	The content script is injected into every HTTP, HTTPS, and local file URL across all frames, including sensitive pages such as online banking, government portals, and local HTML files. Combined with the DOM-injected T…	0.0.30

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/main/LICENSE	https://github.com/twbs/bootstrap/blob/main/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
open-eid.github.io	/chrome-token-signing/missing.html	https://open-eid.github.io/chrome-token-signing/missing.html
open-eid.github.io	/chrome-token-signing/hello.html	https://open-eid.github.io/chrome-token-signing/hello.html
github.com	/open-eid/chrome-token-signing/wiki/DeveloperTips	https://github.com/open-eid/chrome-token-signing/wiki/DeveloperTips
www.id.ee	/en/article/the-latest-version-of-the-id-software-includes-an-innovative-web-eid-interface/	https://www.id.ee/en/article/the-latest-version-of-the-id-software-includes-an-innovative-web-eid-interface/
www.id.ee	/en/include/removing-the-token-signing-extension-from-web-browsers/	https://www.id.ee/en/include/removing-the-token-signing-extension-from-web-browsers/
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
ebs.instructure.com	/*	https://ebs.instructure.com/*

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Как вы задолбали!!!! Ничего не работает!И удалить невозм��жно!!!!Подсказыва��те к��к удалить -если придумываете всякую ерунду!!!!!!!

Irina Funk·23 Jun 2023

Как вы задолбали!!!! Ничего не работает!И удалить невозможно!!!!Подсказывайте как удалить -если придумываете всякую ерунду!!!!!!!

Irina Funk·23 Jun 2023

Как вы задолбали!!!! Ничего не работае��!И удалить невозм��жно!!!!Подсказыва��те к��к удалить -если придумываете всякую ерунду!!!!!!!

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Token signing

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating