Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Transcrypto

CRITICAL RISKRemoved from Chrome Web Store

Transcrypto

ID: dneaknblefhakfhakkoeelipgkipjfmb

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

Extension Info & Metadata

Status

Removed

Version

13.0

Size

0.14 MB

Rating

5.0/5

Reviews

Users

10,000

Type

Extension

Updated

Nov 21, 2024

Publisher Contextual Analysis

Author: gustavo.correaView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Transcrição das legendas do Google Meet

Ferramenta para transcrever as videochamadas do Google Meet

User Growth

Showing data from Jul 01, 2023 to Jun 29, 2024

Versions

No change in user count

Compared to 4 months ago

6 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium2

Low1

Versions scanned

Showing 1 of 8 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
7.0 Code review	7

Extension Version	Code Review Findings
7.0	7

Files with findings

2 distinct paths — top paths by unique finding count:

assets/js/content.js6
assets/js/settings.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	assets/js/content.js (line 641)	Once a Google Doc is created, the extension automatically uploads the full transcript (spoken captions + chat messages from all participants) to the user's Google Drive every 15 seconds throughout the meeting. This co…	7.0
2	Credential Theft	high	assets/js/content.js (line 47)	A hardcoded Google API key ('AIzaSyAXZLrHhuD1WRDrjyNA8Fd6uWXWL0JrJ6E') is embedded directly in the extension source. This key is appended to every Google Drive API request (see line 1193: `url + ?key=${googleDriveApiK…	7.0
3	Unauthorized Data Collection	high	assets/js/content.js (line 908)	The extension silently harvests the full text of every Google Meet chat message, including sender names and timestamps, for all participants in the meeting — not just the extension user. This bulk collection of other …	7.0
4	Unauthorized Data Collection	high	assets/js/content.js (line 766)	The extension captures each meeting participant's display name, profile image URL (scraped from the Google Meet DOM), and real-time speech captions for all speakers — not only the user who installed the extension. The…	7.0
5	Credential Theft	medium	assets/js/content.js (line 1192)	Every outbound Google Drive API request appends the hardcoded developer API key alongside the user's OAuth bearer token. Using both credentials simultaneously on user-driven requests is anomalous — the bearer token al…	7.0
6	Credential Theft	medium	assets/js/content.js (line 1680)	The content script retrieves a live Google OAuth token from the background service worker and stores it in a module-scoped variable (`authToken`). This token grants `drive.file` scope and is used directly in all subse…	7.0
7	Phishing	low	assets/js/settings.js (line 3)	The settings page embeds a hard-coded link to `http://rw3tecnologia.com` over plain HTTP (not HTTPS). This link is rendered in the extension's options page; if the domain is ever hijacked or the DNS record manipulated…	7.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


meet.google.com	/*	https://meet.google.com/*
accounts.google.com	-	https://accounts.google.com/
www.googleapis.com	/auth/drive.file	https://www.googleapis.com/auth/drive.file
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.googleapis.com	/drive/v3/files	https://www.googleapis.com/drive/v3/files
www.googleapis.com	/upload/drive/v3/files	https://www.googleapis.com/upload/drive/v3/files
rw3tecnologia.com	/transcript/index.html	http://rw3tecnologia.com/transcript/index.html
drive.google.com	/drive/folders/$%7Brw3TranscriptFolderInfo[	https://drive.google.com/drive/folders/${rw3TranscriptFolderInfo[
accounts.google.com	/*	https://accounts.google.com/*

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


18.18.43.29	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Transcrypto

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 8 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating