Chrome Web StoreDo not install
Code review: critical (v0.0.23)
Our reviewer read version 0.0.23 of this extension and confirmed malicious behaviour. 3 security findings documented below. Do not install it. Remove it if you already have it.
8 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Wikipedia night mode, used by 30,000 people, is rated malicious by Extension Auditor. Our code review reported 3 findings (1 critical, 2 high), led by other. It comes from a trusted publisher and was last updated in October 2024.
Key findings
- Critical
Other
When a user visits an AliExpress product page, the extension redirects the entire tab through an affiliate tracking URL (reviews.gift → [domain withheld] affiliate ID `1e8d11449439e4a1019b16525dc3e8`) once every 3 days (259200 seconds). This is covert affiliate link hijacking entirely unrelated to Wikipedia night mode, not disclosed in the CWS listing, and operating on [domain withheld] — a host that appears in the bundled manifest but not the published store listing.
- High
Code Injection
After approximately 5 days of installation (period=432000000ms, with first-run seeded 4 days back), the extension injects a full-width fixed-position adware banner at the bottom of every matched page (including Wikipedia) promoting and linking to a different Chrome extension. This is undisclosed ad injection operating outside the extension's stated purpose and not declared in the CWS data-collection disclosure.
- High
Other
The bundled manifest declares `*://*.[domain withheld] as a content script injection target, but this host is completely absent from the published MV3 manifest in the Chrome Web Store listing. The published manifest only covers domains. This deliberate omission conceals the AliExpress affiliate hijacking scope from the store review process and from users inspecting the listing.
Analyst notes
The extension contains two concrete malicious behaviors confirmed in source: (1):1750-1760 redirects AliExpress product page visitors through an undisclosed affiliate tracking URL (reviews.gift → [domain withheld] affiliate ID) every 3 days — completely unrelated to the extension's stated Wikipedia night mode purpose; (2):1780-1815 injects a persistent full-width adware banner on all matched pages after ~5 days promoting a different Chrome extension. These behaviors are corroborated by user reviews ('injects ads, banners, adware…hijacking pages'), by the bundled manifest silently adding `*://*.[domain withheld] as a content script host that is absent from the published MV3 manifest, and by the publisher having 67% () malicious extensions — all signals align, none contradict.
Wikipedia night mode Chrome extension security report
ID: idhghjodolinkdhibgfgfoceackpcjfl
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- grunbaster
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
8 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Wikipedia night mode allows you to work more comfortably on the Wikipedia website in the dark or in low light
Read the publisher’s full description
The dark Wikipedia theme or Wikipedia Night mode changes the background of the Wikipedia website to dark and the font to light. A dark theme for Wikipedia turns on / off by clicking on the extension icon. It is convenient to use at night or in poor lighting, helps your eyes read text more comfortably.
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
8 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from grunbaster
- Random number generator10,000 users
- Dark Mode for Facebook2,000 users
- Package tracker1,837 users
Popular in Accessibility
- Read&Write for Google Chrome™19,000,000 users
- 360 Internet Protection19,000,000 users
- Volume Master7,000,000 users
- Dark Reader7,000,000 users
- Screenshot reader™7,000,000 users