Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Video Downloader Plus

CRITICAL RISKRemoved from Chrome Web Store

Video Downloader Plus

ID: npgkcfnmadahgfpboifplmodkddpcbjp

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.1.10

Size

0.10 MB

Rating

3.9/5

Reviews

187

Users

91,434

Type

Extension

Updated

Jun 2, 2020

Publisher Contextual Analysis

Author: chrome extensionView Profile

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

91,434

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Best video uploads extension. Save most popular media formats from any website.

Safely save video from web! Video Downloader Plus will help you download any video and music from any website! Video Downloader Plus is the most safely video download extension in the Chrome Web store. Get an online video downloader, video player and video playlist in a single package! Install Video Downloader Plus and release all the video power of your Chrome Browser Features - Supports MP4, MOV, FLV, AVI, WEBM, ASF, MPG and many more. - Allows you to skip parts and you don't have to watch ads or boring content again. - Downloads multiple videos simultaneously. - Downloads almost from 99% of video hosting websites. The extension is completely free, safe, fast and easy to add to chrome browser. This is NOT a Youtube Downloader. Due to restrictions of the Google Web store Policies and Developer Program Policies this extension can not download Youtube Videos. Thanks for trying our extension and we hope you find it useful.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High2

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.10 Code review	3

Extension Version	Code Review Findings
1.1.10	3

Files with findings

1 distinct path — top paths by unique finding count:

js/background.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/background.js (line 291)	Every 20 minutes the extension checks whether 24 hours have elapsed since the last beacon; if so, it calls `chrome.cookies.getAll` for `https://google.com/` (the URL is hidden via base64: `atob('aHR0cHM6Ly9nb29nbGUuY2…	1.1.10
2	Network Interception	high	js/background.js (line 156)	When the user has a Twitter `auth_token` cookie the extension registers a blocking webRequest listener that strips all Cookie headers from requests to `api.twitter.com/oauth2/token`. This manipulates Twitter's OAuth t…	1.1.10
3	Obfuscation	high	js/background.js (line 327)	The exfiltration target domain (`https://google.com/`) is deliberately split across two variables (`durToken` and `pfx`) and base64-encoded to avoid trivial string-search detection. Obfuscating the URL of a cookie-har…	1.1.10

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
videodownloader.io	/terms	http://videodownloader.io/terms
4kdownloader.net	/terms	http://4kdownloader.net/terms
api.twitter.com	-	https://api.twitter.com/
5.149.250.80	/wsc	http://5.149.250.80:47263/wsc?v=
jquery.com	-	https://jquery.com/

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


5.149.250.80	IPv4	-
2.3.3.3	IPv4	-
2.3.3.1	IPv4	-

1.7 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

не работает

МГ

Марат Гизатуллин·14 Oct 2020

не работает

МГ

Мар��т Гизату��лин·14 Oct 2020

This isn't detecting anything, therefore it's useless. If anyone can offer advice I'd be grateful.

Carron Carter·10 Oct 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Video Downloader Plus

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version3

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews