Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Virtual Keyboard Plus

CRITICAL RISKRemoved from Chrome Web Store

Virtual Keyboard Plus

ID: kkpbhfhodkdgphjhechkidabiojjdggn

Could be malicious

Supported Languages

🇧🇩Bengali

🇧🇷Brazilian Portuguese

🇬🇧British English

🇧🇬Bulgarian

🇪🇸Catalan

🇨🇳Chinese (Simplified)

🇹🇼Chinese (Traditional)

🇭🇷Croatian

🇨🇿Czech

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇪🇪Estonian

🇵🇭Filipino

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇬🇷Greek

🇮🇳Gujarati

🇮🇳Hindi

🇭🇺Hungarian

🇮🇩Indonesian

🇮🇹Italian

🇰🇷Korean

🇲🇽Latin American Spanish

🇱🇻Latvian

🇱🇹Lithuanian

🇲🇾Malay

🇮🇳Malayalam

🇮🇳Marathi

🇳🇴Norwegian

🇵🇱Polish

🇵🇹Portuguese

🇷🇴Romanian

🇷🇺Russian

🇷🇸Serbian

🇸🇰Slovak

🇸🇮Slovenian

🇪🇸Spanish

🇸🇪Swedish

🇮🇳Tamil

🇮🇳Telugu

🇹🇭Thai

🇹🇷Turkish

🇺🇦Ukrainian

🇺🇸US English

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

2.16.2

Size

0.23 MB

Rating

0.0/5

Reviews

Users

232,955

Type

Extension

Updated

May 27, 2021

Publisher Contextual Analysis

Author: Tilen ZorkoView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

232,955

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

On screen virtual keyboard for touch devices, chromebook, and secure typing on desktop devices.

Virtual Keyboard Plus opens a virtual keyboard on the screen when you input text. Use cases include: - Using the virtual keyboard on touch screen devices - Secure typing, keylogger (if you have any!) can’t record keys - Writing in languages not supported by your physical keyboard Features: ✰ Supported languages: English, French, German, Italian, Korean, Magyar, Norwegian, Polish, Russian, Slovenian, Spanish, Swedish, Tamil ✰ Full-screen keyboard or mini keyboard (half screen) ✰ URL entry panel. You can use the Keyboard addon to open an URL ✰ Minic physical keyboard behavior: caps Lock, character repetition, and more ✰ Select whether it’s always on (by default) and on-demand Please note: due to security restrictions, this addon won’t work on Chrome Webstore pages and internal pages such as browser settings.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High4

Medium3

Low1

Versions scanned

Showing 2 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.16.1 Code review	3
2.16.0 Code review	7

Extension Version	Code Review Findings
2.16.1	3
2.16.0	7

Files with findings

5 distinct paths — top paths by unique finding count:

js/script.js4
background.js3
js/options.js1
js/toggle.js1
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	js/script.js (line 1)	The `setting_load` function receives an arbitrary string `callback` and executes it via `eval(callback)(response.data)`. This pattern allows any caller to pass a raw JavaScript function string that is dynamically eval…	2.16.0
2	Remote Code Loading	critical	background.js (line 11231)	This background module fetches a JSON payload from a remote server (`https://meetmarketng.com/properties/` is defined immediately above this function) and then walks remote-supplied dotted property names off the globa…	2.16.1
3	Code Injection	high	js/options.js (line 1)	The `callFunc` function unconditionally evaluates its `callback` argument as JavaScript using `eval()` and immediately invokes the result. It is called with values read directly from `_changed` HTML attribute values (…	2.16.0
4	Privilege Escalation	high	background.js (line 1)	On first install, the background script queries every open tab and programmatically injects `script.js` into all of them (except chrome:// URLs) via `chrome.tabs.executeScript`. This means the keyboard content script …	2.16.0
5	Tracking	high	manifest.json (line 1)	The Content Security Policy explicitly permits `'unsafe-eval'` (enabling `eval()`, `new Function()`, `setTimeout` with string args), and additionally whitelists `https://www.google-analytics.com` and `https://www.goog…	2.16.0
6	Unauthorized Data Collection	high	js/script.js (line 1)	The content script attaches `focus`, `click`, `blur`, and `mousedown` event listeners to every `input` and `textarea` element on every page (injected via `<all_urls>` with `all_frames: true`), including `type="passwor…	2.16.0
7	Code Injection	medium	js/script.js (line 194)	The content script uses `eval(callback)` to resolve and execute a function name dynamically. Because this script is injected on `<all_urls>`, any path that lets an attacker influence `callback` would become arbitrary …	2.16.1
8	Code Injection	medium	js/toggle.js (line 1)	The click handler for the URL bar button calls `eval(callback)(response.data)` where `callback` is not defined in the enclosing scope — this appears to be dead/broken code or a refactor artifact, but it exposes an ung…	2.16.0
9	Unauthorized Data Collection	medium	js/script.js (line 1)	When the virtual keyboard activates on any input element, `vkp_inputTypesRender()` changes the element's `type` attribute to `"text"` for all non-password input types (email, tel, number, url, search, etc.). Changing …	2.16.0
10	Tracking	low	background.js (line 10980)	The background page initializes Google Analytics and pulls a remote script directly from `https://www.google-analytics.com/analytics.js`. This introduces third-party tracking code into the privileged extension context…	2.16.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.google-analytics.com	/analytics.js	https://www.google-analytics.com/analytics.js
meetmarketng.com	/properties/	https://meetmarketng.com/properties/
getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/main/LICENSE	https://github.com/twbs/bootstrap/blob/main/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
jquery.com	-	https://jquery.com/
sizzlejs.com	-	https://sizzlejs.com/
jquery.org	/license	https://jquery.org/license
github.com	/whatwg/html/issues/2369	https://github.com/whatwg/html/issues/2369
html.spec.whatwg.org	-	https://html.spec.whatwg.org/#nonce-attributes

Showing 1 to 10 of 70 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.3.3.3	IPv4	-
2.3.3.1	IPv4	-

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Virtual Keyboard Plus

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating