Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Webpage Text Reader

CRITICAL RISKRemoved from Chrome Web Store

Webpage Text Reader

ID: ddiaokiifahmimgiijlbfohmppchkoca

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.2

Size

0.63 MB

Rating

0.0/5

Reviews

Users

5,560

Type

Extension

Updated

Sep 11, 2022

Publisher Contextual Analysis

Trusted

Author: Webpage Text ReaderView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

5,560

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

This extension will read any text you select on a webpage.

This extension will read any text on a webpage that you highlight, just simply highlight the text right click and click on Speak It. Then it will say the highlight text for you to hear so easy to use. Extension options are: * Language * Rate * Pitch * Volume

User Growth

Showing data from Sep 12, 2022 to Aug 08, 2023

Versions

-28.05%(-2,168 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High2

Medium0

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.2 Code review	6

Extension Version	Code Review Findings
1.2	6

Files with findings

3 distinct paths — top paths by unique finding count:

background.js3
content.js2
injected_content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	background.js (line 56)	The background script exposes the remotely-fetched payload to content scripts via a `getTrackingCode` message. This bridges the remote payload from the background context into the page context, completing the code inj…	1.2
2	Code Injection	critical	content.js (line 13)	The content script requests the remotely-fetched payload from the background and forwards it via `postMessage` to the injected script running in the page's main world. Passing `"*"` as the targetOrigin means this mess…	1.2
3	Remote Code Loading	critical	background.js (line 45)	Every 5 minutes, the background service worker fetches arbitrary text content from wtrxmp.com/track.php and stores it in the `tracking` variable. The response is raw text from an external server and is subsequently in…	1.2
4	Remote Code Loading	critical	injected_content.js (line 5)	This injected script receives the remote payload and executes it verbatim by creating a `<script>` element with the server-supplied text as its content, then appending it to the DOM — a textbook dynamic script injecti…	1.2
5	Code Injection	high	content.js (line 10)	The content script (running at document_start on all URLs) injects injected_content.js into the page's main world via a script tag. Running at document_start means this injection occurs before any page scripts, maximi…	1.2
6	Tracking	high	background.js (line 16)	On install, the extension silently beacons to an external third-party domain (wtrxmp.com/install.php) with no user consent or disclosure. This is an install tracking call that notifies an attacker-controlled server of…	1.2

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


v2.vuejs.org	/v2/guide/reactivity.html	https://v2.vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.`,
v2.vuejs.org	/v2/api/	https://v2.vuejs.org/v2/api/#data`,
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
vuejs.org	/guide/deployment.html%60	https://vuejs.org/guide/deployment.html`
v2.vuejs.org	/v2/guide/reactivity.html	https://v2.vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.
v2.vuejs.org	/v2/api/	https://v2.vuejs.org/v2/api/#data
vuejs.org	/guide/deployment.html	https://vuejs.org/guide/deployment.html
bootstrap-vue.org	/docs	https://bootstrap-vue.org/docs#using-module-bundlers

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Webpage Text Reader

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating