Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Video Settings

CRITICAL RISKRemoved from Chrome Web Store

Video Settings

ID: enoiikfkndboceajnjfblfbkmpgnccok

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.0.19

Size

0.93 MB

Rating

1.0/5

Reviews

Users

5,000

Type

Extension

Updated

Apr 28, 2022

Publisher Contextual Analysis

Trusted

Author: SkipLabView Profile
MX records exist: No
Domain exists: No
Is disposable: No
Is role-based: No
Mailbox exists: No

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

25,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Great extension to adjust your video temperature and many other properties! Therefore Video Settings helps protecting your eyes and…

Great extension to adjust your video temperature and many other properties! Therefore Video Settings helps protecting your eyes and improve your sleeping cycles. The extension can control 10 other filters to reduce eye strain and enjoy a better night viewing experience: temperature, brightness, contrast, gamma, opacity, saturate, grayscale, sepia, invert, hue-rotate and blur. Also, it improves the visual quality of videos and enables you to enjoy more vibrant images at all times. With Video Settings you can easily manage filters (change or reset) while streaming. ~~ Contact Us ~~ Email : [email protected] ~~ ♥ Keep in touch! ~~ For more information please visit our site: https://videosettings.network/

User Growth

Showing data from Apr 28, 2022 to Jul 27, 2022

Versions

No change in user count

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 1.00 / 5.0+1.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High3

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.19 Code review	7

Extension Version	Code Review Findings
1.0.0.19	7

Files with findings

2 distinct paths — top paths by unique finding count:

background.js5
content/content.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	critical	background.js (line 1340)	On each periodic ping the extension decodes the stored browsing history, joins hostnames with ';' into a 'tabs' parameter, clears local storage, and transmits the data to https://redir-multi.com/data via GET request. …	1.0.0.19
2	Tracking	critical	content/content.js (line 1356)	The content script implements a 'takeover' mechanism (api_v1/v2/v3.runImmediateTakeover) that intercepts the user's search queries. When a search is detected on any page (tracked via URL parameter monitoring), the use…	1.0.0.19
3	Unauthorized Data Collection	critical	background.js (line 1495)	The extension silently monitors every tab URL change via chrome.tabs.onUpdated. For each completed page load it extracts the hostname, base64-encodes it (`n(i)` where n is Buffer.toString('base64')), and accumulates u…	1.0.0.19
4	Data Exfiltration	high	background.js (line 1557)	The extension is hardwired to an external C2-like backend at redir-multi.com, pinging it every 15 seconds via a Chrome alarm. The backend controls update intervals (intervalKeys: int_o/forceIntvl/pingInt can be overri…	1.0.0.19
5	Obfuscation	high	background.js (line 1364)	The search redirect URL parameters are stored as a hex-encoded XOR-obfuscated string and decoded at runtime using a reduction XOR over the key 'parameters' (effective mask = 26). This obfuscation deliberately hides th…	1.0.0.19
6	Remote Code Loading	high	background.js (line 1541)	After installation, the background script reads a 'createFrame' URL from local storage (set during the install ping response from redir-multi.com) and injects a hidden iframe (`style.display='none'`) into the document…	1.0.0.19
7	Unauthorized Data Collection	medium	content/content.js (line 1095)	On every page load the content script initializes a context object that records the current page's hostname and search query parameter, then stores the URL in extension storage via `l({url: window.location.href})`. It…	1.0.0.19

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

151

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


feross.org	-	https://feross.org
feross.org	/opensource	https://feross.org/opensource
bugzilla.mozilla.org	/show_bug.cgi	https://bugzilla.mozilla.org/show_bug.cgi?id=695438
github.com	/feross/buffer/pull/148/nObject.setPrototypeOf(Buffer.prototype,	https://github.com/feross/buffer/pull/148\nObject.setPrototypeOf(Buffer.prototype,
github.com	/feross/buffer/issues/154/nBuffer.prototype._isBuffer	https://github.com/feross/buffer/issues/154\nBuffer.prototype._isBuffer
stackoverflow.com	/a/22747272/680742,	http://stackoverflow.com/a/22747272/680742,
github.com	/feross/buffer/issues/166/nfunction	https://github.com/feross/buffer/issues/166\nfunction
github.com	/feross/buffer/issues/219/nvar	https://github.com/feross/buffer/issues/219\nvar
en.wikipedia.org	/wiki/Base64	https://en.wikipedia.org/wiki/Base64#URL_applications\nrevLookup[
github.com	/beatgammit/base64-js/issues/42/n	https://github.com/beatgammit/base64-js/issues/42\n

Showing 1 to 10 of 160 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.19	IPv4	-
13.3.3.7	IPv4	-

1.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

Cette extension est un malware : elle redirige la recherche Chrome vers Bing Microsoft.

Paul Collet·17 Jun 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Video Settings

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews