Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: unitab.me

CRITICAL RISKRemoved from Chrome Web Store

unitab.me

ID: okfhcaaechgilnichghjfpdljeioelgm

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.2.0.2

Size

12.81 MB

Rating

4.3/5

Reviews

Users

40,000

Type

Extension

Updated

Jan 29, 2024

Publisher Contextual Analysis

Author: UnitabView Profile
Privacy: Privacy Policy
Country: IL
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: Tiomkin St 16 Tel Aviv-Yafo 6578317 IL

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

60,044

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Unitab - A new tab experience in your browser

The Unitab “new tab” page is a center of information. It includes various bits of information you can turn the different parts of its experience on and off. In order to support the features of the extension, The extension will update your new-tab search provider to be powered by Microsoft Bing. By clicking “Add to chrome”, I accept and agree to installing the Unitab's Chrome extension and setting Chrome™ New Tab to that provided by the service and the Terms of Use (https://Unitab.me/trms/) and Privacy Policy (http://Unitab.me/pp/). Powered by 50m.media LTD Technology - we are 100% FREE! How do I uninstall the Unitab extension? On the top right of your screen, right click the Extension icon and choose "Remove from Chrome".

User Growth

Showing data from Apr 21, 2024 to Feb 06, 2025

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 35 ratings

Average Rating

Current: 4.34 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High3

Medium2

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2.0.2 Code review	7

Extension Version	Code Review Findings
1.2.0.2	7

Files with findings

2 distinct paths — top paths by unique finding count:

js/background.js6
jsonParam.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	js/background.js (line 146)	On install, the extension beacons a tracking pixel to the suspicious `efeho.pw` domain (a .pw TLD commonly abused for PUP/affiliate fraud infrastructure) carrying a partner id (`pid=0d5ae91f`), a distribution hash id …	1.2.0.2
2	Tracking	high	js/background.js (line 28)	The extension uses the `cookies` permission to harvest affiliate/attribution identifiers (`partner_id`, `click_id`, `traffic_source`, `campaign`, `mkt_material`, `spid`, `sspid`, `ssspid`, `channel_id`, `dhid`, `serve…	1.2.0.2
3	Tracking	high	jsonParam.json (line 1)	Bundled config file embeds a remote `server_address` endpoint (`https://clt.uxlizap.pw/pa/weather_defines`) on the suspicious `.pw` TLD plus post-install and `update_url` beacons to `weathertime.today` — domains unrel…	1.2.0.2
4	Unauthorized Data Collection	high	js/background.js (line 252)	The uninstall URL is configured to exfiltrate the machine id (`mid`), distribution hash id (`dhid`), version, install date, and traffic source to a remote server on uninstall. This is user lifecycle tracking tied to p…	1.2.0.2
5	Tracking	medium	js/background.js (line 266)	If no `mid` cookie is present, the extension mints a persistent GUID that is then stored in `chrome.storage.sync` and exfiltrated on every install-ping and uninstall URL. This creates a stable supercookie-style tracki…	1.2.0.2
6	Unauthorized Data Collection	medium	js/background.js (line 298)	Queries `https://jsonip.com` to obtain the user's public IP address and stores it in a global, alongside reference to `mysupertab.com` (a known PUP/newtab hijacker family). IP geolocation + machine id tracking is a kn…	1.2.0.2
7	Code Injection	low	js/background.js (line 280)	Defines a helper that calls the MV2-era `chrome.tabs.executeScript` API to inject `js/googleAnalytics.js` into tabs. The file is not present in the bundle and the API is unavailable in MV3 without the `scripting` perm…	1.2.0.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

174

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.reddit.com	-	https://www.reddit.com
www.instagram.com	-	https://www.instagram.com
www.tumblr.com	-	https://www.tumblr.com
m.facebook.com	/messages	https://m.facebook.com/messages
www.facebook.com	-	https://www.facebook.com
www.youtube.com	-	https://www.youtube.com
www.gmail.com	-	https://www.gmail.com
map.google.com	-	https://map.google.com
www.netflix.com	-	https://www.netflix.com
www.spotify.com	-	https://www.spotify.com

Showing 1 to 10 of 180 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-
1.2.0.2	IPv4	-

4.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

nice

Pipaliya Dharmik·8 Mar 2023

iaa

Krish Navadia·5 Mar 2023

JOB SUCCESSFULLY DONNE

qadri qadri·5 Mar 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

unitab.me

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating