Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Twitch™ Adblock Plus

CRITICAL RISKRemoved from Chrome Web Store

Twitch™ Adblock Plus

ID: gfldbgjeciegongbgffhdpbgobjdcmgm

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇯🇵Japanese

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

3.0.0

Size

0.06 MB

Rating

2.4/5

Reviews

106

Users

34,198

Type

Extension

Updated

Jul 22, 2023

Publisher Contextual Analysis

Author: Purple Twitch™ AdblockerView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

34,198

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

The Twitch™ Adblock Plus extension helps you block unwanted Twitch.tv ads without compromising quality.

The Twitch™ Adblocker Plus extension is an adblocker for Twitch.tv. This extension is helpful for blocking commercials. This extension blocks ads without switching to lower quality. How to use the Twitch™ adblock extension: 1. Install the extension 2. Pin it in the toolbar 3. Click the extension icon and enable the adblocker with the toggle button. 4. Then, play any video on twitch.tv Note: This extension does not collect/share any of your personal information and it is based on the open-source code. The extension requires such permissions as: - "Access data for all websites": to block ads coming from multiple sites. - "Access to browser tabs" to get details about the website you visit (website url, tab id, parent tab id). It helps us to block ad requests. - “Notifications”: to send the important adblocking notifications.

User Growth

Showing data from Nov 05, 2022 to Jul 31, 2023

Versions

+130.07%(+19,334 users)

Compared to 3 months ago

10 versions released in this period

Rating Count

Total: 106 ratings+61 (136%)

Average Rating

Current: 2.38 / 5.0+2.38

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High1

Medium4

Low0

Versions scanned

Showing 1 of 10 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.0.0 Code review	7

Extension Version	Code Review Findings
3.0.0	7

Files with findings

2 distinct paths — top paths by unique finding count:

js/bg.js4
js/main.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	critical	js/bg.js (line 145)	Installs a global declarativeNetRequest rule that strips X-Frame-Options, Frame-Options, and Content-Security-Policy response headers from every main_frame/sub_frame/script response on all sites (the rule has no domai…	3.0.0
2	Remote Code Loading	critical	js/bg.js (line 192)	Implements a remote command-and-control channel via Google Cloud Messaging (chrome.gcm). The operator can push JSON messages that cause the extension to (a) silently navigate the user's currently focused tab to an att…	3.0.0
3	Tracking	high	js/bg.js (line 236)	On any tab URL change, the service worker pushes the new URL to the page's content script via chrome.tabs.sendMessage. Combined with broad host_permissions (':///*') and the document_start content script, this lets …	3.0.0
4	Code Injection	medium	js/main.js (line 377)	Subclasses window.Worker so the page's normal Worker constructor is replaced with one that builds JS source by string-concatenating function bodies and a remotely-loaded importScripts URL, then instantiates the worker…	3.0.0
5	Network Interception	medium	js/main.js (line 438)	Overrides window.fetch in the page context to intercept and harvest Twitch authentication-related headers (Client-ID, Client-Version, Client-Session-Id, Device-ID/X-Device-Id) from outgoing access_token/gql requests a…	3.0.0
6	Remote Code Loading	medium	js/main.js (line 45)	Performs a synchronous XMLHttpRequest against an arbitrary URL passed to the Worker constructor and parses a quoted string out of the response, then injects that URL into a dynamically-built Blob worker via importScri…	3.0.0
7	Unauthorized Data Collection	medium	js/bg.js (line 180)	On install the extension force-opens an external Chrome Web Store URL plus a separate focused popup window. Combined with the GCM 'oibww_pending' storage key (set when no http(s) tab is available so the redirect fires…	3.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fonts.googleapis.com	/css	https://fonts.googleapis.com/css?family=Roboto:300,500
chrome.google.com	/webstore/detail/purple-adblock-for-twitch/gfldbgjeciegongbgffhdpbgobjdcmgm	https://chrome.google.com/webstore/detail/purple-adblock-for-twitch/gfldbgjeciegongbgffhdpbgobjdcmgm
*	/*	http:///
*	/*	https:///
localhost	-	https://localhost/
api.ttv.lol	/playlist/	https://api.ttv.lol/playlist/
ttv.lol	/donate	https://ttv.lol/donate
usher.ttvnw.net	/api/channel/hls/	https://usher.ttvnw.net/api/channel/hls/
gql.twitch.tv	/gql	https://gql.twitch.tv/gql
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

2.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Funktioniert nicht

Thomas K·30 Jul 2023

Works great, thanks.

The-Disabled-Gamer·30 Jul 2023

doesnt work

Nullzog·28 Jul 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Twitch™ Adblock Plus

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 10 Versions7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating