Security Alert: Confirmed Malware
unrolld
ID: bjkgggkbokfjifbjeehgdlecfjilmjpk
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Strange Clouds Inc.View Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Rate and review Cannabis across Ontario.
unrolld is Ontario's resource for rating and reviewing products available at the Ontario Cannabis Store website.
The content script injects a DOM login form containing email+password <input> fields directly into ocs.ca pages (and a matching signup form at line 624). Because the overlay is rendered inside a third-party site rather than in the extension popup, users can be misled into believing they are entering credentials into ocs.ca. This is a phishing-adjacent pattern even when the credentials are used for the extension's own Firebase auth.
E = function(e) { document.body.classList.add("overflow-hidden"); var t = document.createElement("div"); t.id = "unrolld-login", t.innerHTML = '\n <div class="w-full max-w-md p-8 space-y-3 rounded-xl text-gray-900 bg-white relative shadow-xl">\n ... <h1 class="text-2xl font-bold text-center text-gray-900">Login</h1>\n <form novalidate="" action="" class="space-y-6 ng-untouched ng-pristine ng-valid">\n ... <input type="email" name="email" ...>\n <input type="password" name="password" ...>\n <button ...>Sign in</button>\n ...' document.body.appendChild(t);... // triggered by: chrome.runtime.onMessage ... "injectLogin" -> E(v)Form submit handlers harvest the email and password entered on the injected overlay and forward them via chrome.runtime.sendMessage to the background service worker. The background script then ships the credentials out to Firebase Auth (unrolld-extension.firebaseapp.com / identitytoolkit.googleapis.com). This is the same code shape credential stealers use; while here the destination is the extension's own backend, it is the pattern the ML model is almost certainly flagging.
v = function(e) { e.preventDefault(), chrome.runtime.sendMessage({ command: "login", data: { email: e.target.email.value, password: e.target.password.value } }, (function(e) { ... })) }, g = function(e) { e.preventDefault(), chrome.runtime.sendMessage({ command: "register", data: { email: e.target.email.value, password: e.target.password.value } }, ...)Review images chosen by the user are uploaded via an unauthenticated POST to a hardcoded third-party Cloudinary account (strangeclouds, preset ardhbad4). There is no server-side validation of the content before it is sent off-origin, and the endpoint is not declared in host_permissions (the fetch goes out from the content script on ocs.ca). Exfiltrating file contents to an arbitrary third-party bucket is a standard data-exfiltration primitive.
a = n.target.images.files, "https://api.cloudinary.com/v1_1/strangeclouds/image/upload", i = new FormData, e.next = 8, Promise.all(Array.from(a).map(function() { ... return i.append("file", t), i.append("upload_preset", "ardhbad4"), e.next = 4, fetch("https://api.cloudinary.com/v1_1/strangeclouds/image/upload", { method: "POST", body: i }).then((function(e) { return e.json() }));The service worker initializes a Firebase app pointed at the 'unrolld-extension' project and wires chrome.runtime.onMessage handlers that authenticate with Firebase using the email/password harvested by the injected form, then fetch the user's record from the Realtime Database. All account and review data leaves the user's browser to this third-party Firebase backend, which is the exfiltration sink the ML model is most likely responding to even though the flow is by design.
apiKey: "AIzaSyDillcBlZjMrYnKsRHT2begxDhWGNgdARM", authDomain: "unrolld-extension.firebaseapp.com", projectId: "unrolld-extension", storageBucket: "unrolld-extension.appspot.com", messagingSenderId: "537627294096", appId: "1:537627294096:web:f92d1b25dc55978df41b15", measurementId: "G-23RW2C8NJX"})), Rc = ...chrome.runtime.onMessage.addListener((function(e, t, n) { var i = e.command, ... switch (i) { case "injectLogin": ... case "user": Pc ? Sr(br(Nc, "users/".concat(Pc)))... case "login" : (function(e, t, n) { return pa(F(e), Xo.credential(t, n)) }By severity
Versions scanned
Showing 1 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.0.3 | 4 |
Files with findings
2 distinct paths — top paths by unique finding count:
- contentScript.bundle.js3
- background.bundle.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.