Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: twDisplayVicinity

CRITICAL RISKRemoved from Chrome Web Store

twDisplayVicinity

ID: anmfeeanmnmdkjlhojpodibignbcfgjm

Could be malicious

Supported Languages

🇺🇸English

🇯🇵Japanese

Extension Info & Metadata

Status

Removed

Version

0.3.3.0

Size

0.20 MB

Rating

4.5/5

Reviews

Users

11,523

Type

Extension

Updated

Sep 29, 2022

Publisher Contextual Analysis

Trusted

Author: https://memo.furyutei.workView Profile
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

286,858

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Display the vicinity of a particular tweet on Twitter.

On Twitter's official website (https://twitter.com/*), display tweets before and after a specific tweet in timeline format. It is useful when you want to know what the same person is tweeting about before and after a tweet. ========== - Retweeted - Introduced in blogs etc. - Hit with search engine You might not know what tweets were around before and after. If you can read the tweets before and after, you may be able to see an unexpected context you did not understand from a single tweet. When installing this extension, the "vicinify(neighbor)" link will be displayed when you see Twitter's timeline or single tweet. By clicking on this link, a separate tab / another window opens, you can see the timeline before and after that tweet. Also, if your tweets are retweeted, opening the "Notification" timeline (https://twitter.com/i/notifications) will also display the "vicinity" link in the notice of the retweet. By clicking, you can see what the person is tweeting about RT tweets.

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

+7.57%(+811 users)

Compared to 3 months ago

7 versions released in this period

Rating Count

Total: 39 ratings

Average Rating

Current: 4.51 / 5.0+0.01

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High5

Medium4

Low0

Versions scanned

Showing 1 of 22 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.3.3.0 Code review	9

Extension Version	Code Review Findings
0.3.3.0	9

Files with findings

6 distinct paths — top paths by unique finding count:

scripts/background.js3
scripts/fetch_wrapper.js2
scripts/feature_switch.js1
scripts/inject_script.js1
scripts/intercept_xhr.js1
scripts/main_react.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	scripts/inject_script.js (line 84)	Provides generic helpers (inject_script_sync, inject_code, inject_code_sync) that lift a nonce off the host page's existing <script nonce> tag and use it to inject extension-controlled <script> elements (or arbitrary …	0.3.3.0
2	Credential Theft	high	scripts/fetch_wrapper.js (line 149)	Hardcodes Twitter web-client bearer tokens and harvests the user's ct0 CSRF cookie directly from document.cookie to forge authenticated OAuth2Session calls against api.twitter.com with credentials:'include'. This impe…	0.3.3.0
3	Credential Theft	high	scripts/main_react.js (line 979)	Same credential-forging pattern repeated in the main content script: reads ct0 from document.cookie and combines it with hardcoded Twitter web bearer tokens to build OAuth2Session-authenticated API request headers. Th…	0.3.3.0
4	Network Interception	high	scripts/intercept_xhr.js (line 13)	Monkey-patches XMLHttpRequest.prototype.open to silently rewrite both the destination URL (via url_filter) and the responseText / responseURL the calling page sees (via response_filter). Object.defineProperty is used …	0.3.3.0
5	Privilege Escalation	high	scripts/background.js (line 270)	Uses declarativeNetRequest to forcibly downgrade Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy on twitter.com responses to 'unsafe-none'. Weakening these browser-level isolation headers reduces cross-ori…	0.3.3.0
6	Network Interception	medium	scripts/background.js (line 299)	Strips the Cookie header from requests to api.twitter.com/oauth2/token (so the extension can mint anonymous app-only OAuth2 access tokens against the Twitter API without binding them to the user) and spoofs the User-A…	0.3.3.0
7	Network Interception	medium	scripts/background.js (line 164)	The service worker exposes a generic FETCH_JSON message handler that performs an arbitrary fetch() on any URL/options provided by content scripts and returns the parsed JSON. Although callers in this extension only pa…	0.3.3.0
8	Other	medium	scripts/feature_switch.js (line 19)	Reaches into Twitter's React app private state (window.__INITIAL_STATE__.featureSwitch) using a MutationObserver and silently flips the user's server-delivered feature flags (responsive_web_graphql_profile_timeline) t…	0.3.3.0
9	Unauthorized Data Collection	medium	scripts/fetch_wrapper.js (line 162)	Captured XHR request bodies and decoded JSON responses for every twitter.com API call are forwarded via window.postMessage to the content script for further processing. While the target origin is restricted to locatio…	0.3.3.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


github.com	/furyutei/twMediaDownloader/issues/89	https://github.com/furyutei/twMediaDownloader/issues/89#issuecomment-1261621380
groups.google.com	/a/chromium.org/g/chromium-extensions/c/lLb3EJzjw0o	https://groups.google.com/a/chromium.org/g/chromium-extensions/c/lLb3EJzjw0o
github.com	/furyutei/twDisplayVicinity_Chrome	https://github.com/furyutei/twDisplayVicinity_Chrome
memo.furyutei.work	/about	https://memo.furyutei.work/about#send_donation
www.inkscape.org	-	http://www.inkscape.org/
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
creativecommons.org	/ns	http://creativecommons.org/ns#
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
www.openswatchbook.org	/uri/2009/osb	http://www.openswatchbook.org/uri/2009/osb
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#

Showing 1 to 10 of 90 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


0.3.3.0	IPv4	-
0.3.2.25	IPv4	-
0.2.6.15	IPv4	-
0.2.3.10	IPv4	-
0.2.6.7	IPv4	-

4.6 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

ずっと使わせていただいて感謝していま��。ここ数か月��「ユーザータイム��インを表示」の設定で使用するとhttps://twitter.com/sakura_ariake/with_replies?max_id=(数字)のペー��に飛んでも「@(ユーザ名)さんは��だツイートしていません」と表示されるのみに��って��まい、「検索タ��ムラインを表示」��機能を��いる必要のある状況が頻繁に発生します（後者だと、@(ユーザ名)の前後のRTを追えず文脈が不明で少し使いづらい）この原因がおま環なのかTwitterの仕様変更が原因のどちらなのか分かりますか？

nana nanani·1 Jul 2023

ずっと使わせていただいて感謝していま��。ここ数か月��「ユーザータイム��インを表示」の設定で使用するとhttps://twitter.com/sakura_ariake/with_replies?max_id=(数字)のペー��に飛んでも「@(ユーザ名)さんは��だツイートしていません」と表示されるのみに��って��まい、「検索タイムラインを表示」��機能を��いる必要のある状況が頻繁に発生します（後者だと、@(ユーザ名)の前後のRTを追えず文脈が不明で少し使いづらい）この原因がおま環なのかTwitterの仕様変更が原因のどちらなのか分かりますか？

nana nanani·1 Jul 2023

ずっと使わせていただいて感謝していま��。ここ数か月��「ユーザータイム��インを表示」の設定で使用するとhttps://twitter.com/sakura_ariake/with_replies?max_id=(数字)のペー��に飛んでも「@(ユーザ名)さんは��だツイートしていません」と表示されるのみに��て��まい、「検索タ��ムラインを表示」��機能を��る必要のある状況が頻繁に発生します（後者だと、@(ユーザ名)の前後のRTを追えず文脈が不明で少し使いづらい）この原因がおま環なのかTwitterの仕様変更が原因のどちらなのか分かりますか？

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

twDisplayVicinity

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 22 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating