Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Trello

CRITICAL RISKRemoved from Chrome Web Store

Trello

ID: dmdidbedhnbabookbkpkgomahnocimke

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

0.0.49

Size

0.22 MB

Rating

3.9/5

Reviews

282

Users

164,212

Type

Extension

Updated

Jul 26, 2018

Publisher Contextual Analysis

Author: trello-chrome-extensionView Profile

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

164,212

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Quickly create Trello cards and access your Trello boards from the Omnibox.

Create Trello cards directly from Chrome without ever going to Trello and hunting down the board and the list. Access your boards as easily as you can search Google. Go to the address bar, enter t followed by a space and then start typing the name of the board you want. Handy.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High2

Medium2

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.49 Code review	5

Extension Version	Code Review Findings
0.0.49	5

Files with findings

2 distinct paths — top paths by unique finding count:

scripts/app.js4
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	manifest.json (line 39)	The Content Security Policy explicitly allows `unsafe-eval`, overriding Chrome's default extension CSP which prohibits it. This permits runtime execution of dynamically constructed code strings via `eval()`, `Function…	0.0.49
2	Unauthorized Data Collection	high	scripts/app.js (line 473)	The extension requests an OAuth token with `expiration=never` and `scope=read,write,account`, granting itself permanent read/write access to the authenticated user's entire Trello account including boards, cards, and …	0.0.49
3	Credential Theft	medium	scripts/app.js (line 470)	The OAuth token is extracted directly from the URL hash fragment (`window.location.href.split('#token=')`). Because `login.html` is listed in `web_accessible_resources` in the manifest, any malicious webpage can load …	0.0.49
4	Other	medium	scripts/app.js (line 31)	The Trello API application key `41257716bae3f0f35422a228fbd18c97` is hardcoded in plain text directly in the extension source. Anyone who unpacks the CRX can extract this key and use it to make API calls attributed to…	0.0.49
5	Unauthorized Data Collection	low	scripts/app.js (line 554)	The extension uses the deprecated `chrome.tabs.getSelected` API to read the active tab's URL and page title, storing both in the `currentTab` object. While the stated purpose is to optionally attach the current URL to…	0.0.49

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
trello.com	-	https://trello.com/
trello.com	/c/St4Y4WR7/222-aaa	https://trello.com/c/St4Y4WR7/222-aaa
api.trello.com	-	https://api.trello.com
trello.com	-	https://trello.com
select2.github.io	/announcements-4.0.html	https://select2.github.io/announcements-4.0.html#changed-id
npms.io	/search	https://npms.io/search?q=ponyfill.
api.trello.com	/1/members/me	https://api.trello.com/1/members/me
api.trello.com	/1/boards/	https://api.trello.com/1/boards/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

didnt work

Fqk Lin·18 Apr 2021

It's OK for starters, but I think it could easily be better if it: - Allowed the assignment of a label - Allowed the assignment of a due date - Allowed to set up the location desired for the card between the top and the bottom of the list It seems like this extension has not been updated in a long time, hence, I wonder if there's still a development team behind it?

Laura Ramírez·23 Feb 2021

Would be 5. But the T+space function to look fast for trello boards is not working anymore. Probably due to chrome updates itself, now if i press T and Chrome browser asking me if i want to "search on trello" which then does the same as the app, but you always have to use the mouse to click on it, which is not really what i am looking for. going back to 5 stars after its fix

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Trello

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews