Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: USOP-Passport

CRITICAL RISKRemoved from Chrome Web Store

USOP-Passport

ID: hmpdmcjnegjnadjdcipajfhclglaoegh

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.05

Size

0.39 MB

Rating

0.0/5

Reviews

Users

Type

Extension

Updated

Feb 1, 2025

Publisher Contextual Analysis

Author: uroinvoView Profile
Privacy: Privacy Policy
Help: Help Center
Country: India
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: C-67, Sector-63 Noida 201301 India

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

This extension will use for visitors allow and deny

USOP-pasport is a companion application for browser to facilitate UROSECURE services for its user. I facilitate USOSECURE user to know the unknown guest in less that 10 minutes

User Growth

Showing data from Feb 01, 2025 to May 01, 2026

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High6

Medium3

Low1

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.05 Code review	10

Extension Version	Code Review Findings
1.05	10

Files with findings

8 distinct paths — top paths by unique finding count:

background.js2
login.js2
alert.js1
analytics.js1
fcm.js1
login.html1
popup.js1
view.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	popup.js (line 33)	Raw server-pushed fields (name, mobile, address, imagelink) arriving via GCM/FCM are concatenated into HTML and assigned via innerHTML without sanitization. A compromised or malicious server can inject arbitrary HTML/…	1.05
2	Code Injection	high	alert.js (line 82)	Server response body is inserted directly into the extension page via innerHTML. Because `serverurl` is dynamically loaded from IndexedDB/localStorage (and the login flow writes whatever server the remote API dictates…	1.05
3	Credential Theft	high	login.js (line 45)	The login flow harvests the user's phone number, OTP, CPU architecture/model name, and operating system, then exfiltrates them to ai.urosecure.com as GET query-string parameters. Transmitting authentication credential…	1.05
4	Data Exfiltration	high	background.js (line 247)	The service worker re-sends the stored phone number, membership ID, OTP and FCM registration token to ai.urosecure.com on every startup/alarm. Credentials are passed as GET parameters and the OTP is persisted in Index…	1.05
5	Remote Code Loading	high	fcm.js (line 2)	Extension module dynamically imports Firebase SDK directly from gstatic.com at runtime. Remote-hosted module imports in a Chrome extension violate MV3 CSP expectations and allow the upstream host to ship arbitrary Jav…	1.05
6	Unauthorized Data Collection	high	login.js (line 5)	Silent collection of CPU architecture, CPU model name and OS platform at login time — data placed into hidden inputs (demo1/demo2) that are subsequently exfiltrated to the remote server. The `chrome.system.cpu` permis…	1.05
7	Code Injection	medium	background.js (line 332)	The service worker calls `chrome.tabs.executeScript` with an inline `code:` string to run JavaScript in the current tab. This is the deprecated MV2 dynamic-code-injection API (removed in MV3) being invoked from an MV3…	1.05
8	Network Interception	medium	view.js (line 2)	The extension polls IndexedDB every 10 ms to refresh the server base URL into localStorage. Continuously mutable server endpoints (rather than a hard-coded trusted origin) enable silent C2 redirection — the operator c…	1.05
9	Remote Code Loading	medium	analytics.js (line 1)	Injects a <script> tag loading ga.js from google-analytics.com into the extension page. This is remote script injection (disallowed under MV3) and also sends extension-page activity to a third-party analytics endpoint.	1.05
10	Obfuscation	low	login.html (line 1)	The login HTML is heavily mangled with whitespace/line-break noise that breaks conventional parsing while still functioning. This non-standard formatting is consistent with lightweight obfuscation intended to impede s…	1.05

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


ai.urosecure.com	-	https://ai.urosecure.com
www.gstatic.com	/firebasejs/9.0.0/firebase-app.js	https://www.gstatic.com/firebasejs/9.0.0/firebase-app.js
www.gstatic.com	/firebasejs/9.0.0/firebase-messaging.js	https://www.gstatic.com/firebasejs/9.0.0/firebase-messaging.js
your.url	/here	https://your.url/here
www.whatwg.org	/specs/web-apps/current-work/multipage/section-sql.html	http://www.whatwg.org/specs/web-apps/current-work/multipage/section-sql.html
nightly.webkit.org	-	http://nightly.webkit.org/
gcmnotifaction-e38da.firebaseio.com	-	https://gcmnotifaction-e38da.firebaseio.com
ajax.googleapis.com	/ajax/libs/jquery/3.2.1/jquery.min.js	https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
ssl.google-analytics.com	/ga.js	https://ssl.google-analytics.com/ga.js
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

USOP-Passport

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating