Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: WinSafe - быстрый доступ к сайтам!

CRITICAL RISKRemoved from Chrome Web Store

WinSafe - быстрый доступ к сайтам!

ID: bgnodfikjoihkcjjnefbjkeclamhipak

Could be malicious

Supported Languages

🇷🇺Russian

Extension Info & Metadata

Status

Removed

Version

17.44

Size

0.89 MB

Rating

1.0/5

Reviews

Users

600,000

Type

Extension

Updated

Jun 17, 2023

Publisher Contextual Analysis

Trusted

Author: juanabailey363View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

732,065

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Бесперебойный доступ к вашим сайтам!

Разблокируйте сайты, заблокированные в вашей стране, компании или школе, с помощью WinSafe . WinSafe - это бесплатный прокси-сервис VPN без рекламы, который обеспечивает более быстрый и более открытый Интернет. Это не одноранговое приложение. Это расширение не ссылается и не поощряет загрузку каких-либо других продуктов и является полностью функциональным как есть, не требуя дополнительной загрузки. Если у вас есть какие-либо технические проблемы, пожалуйста, напишите нам по адресу [email protected] WinSafe требует следующих разрешений: - Proxy: расширение WinSafe проксирует ваш трафик через сервер в другой страна, чтобы изменить свой IP и разблокировать ограниченные сайты. - AllHosts / WebRequest / WebRequestBlocking: позволить расширению WinSafe проверять каждый веб-запрос и изменять его.. - Tabs: WinSafe отслеживает ваши вкладки и включает VPN только на определенных вкладках и показывает всплывающее окно на странице, чтобы позволить вам включать, отключать и исправлять проблемы с подключением. - Cookies: WinSafe получит доступ к вашим куки. Некоторые сайты кэшируют вашу страну в файлах cookie, и необходимо очистить их, прежде чем вы сможете получить доступ к этому сайту из другой страны. - Stroge: WinSafe хранит локальную конфигурацию и данные кеша.

User Growth

Showing data from Nov 08, 2022 to Nov 07, 2023

Versions

-22.56%(-174,839 users)

Compared to 3 months ago

5 versions released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 1.00 / 5.0+1.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High8

Medium2

Low0

Versions scanned

Showing 2 of 5 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
17.22 Code review	6
15.50 Code review	8

Extension Version	Code Review Findings
17.22	6
15.50	8

Files with findings

2 distinct paths — top paths by unique finding count:

dist/scripts/bg.wp.js11
dist/scripts/content.wp.js3

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	dist/scripts/bg.wp.js (line 29)	The extension injects base64-encoded proxy credentials into the `Authorization` and `Proxy-Authorization` HTTP request headers of every HTTPS main-frame navigation via a declarativeNetRequest rule. This means the prox…	15.50
2	Privilege Escalation	critical	dist/scripts/bg.wp.js (line 24143)	This code disables other installed extensions by ID using `chrome.management.setEnabled(n, false)`. Combined with the server-loaded `disableExtList` configuration elsewhere in the bundle, it gives a remote party the a…	17.22
3	Remote Code Loading	critical	dist/scripts/content.wp.js (line 29)	The content script accepts a domain configuration message from the background page and dynamically creates `<script>` elements pointing to `https://winsafe-vpn.ru/public/src/<hash>.js`, then prepends them to `document…	15.50
4	Unauthorized Data Collection	critical	dist/scripts/content.wp.js (line 29)	The content script scans search result pages on Google, Yandex, Bing, and Yahoo, overlays an invisible/small clickable image on each organic result link, and intercepts the user's click via `onClick` / `n.preventDefau…	15.50
5	Code Injection	high	dist/scripts/content.wp.js (line 2938)	The content script clones existing page iframes, swaps in an alternate ad/video iframe, and controls it via `postMessage`. Injecting replacement media into arbitrary pages is a strong sign of ad injection or content m…	17.22
6	Code Injection	high	dist/scripts/bg.wp.js (line 10291)	This routine injects code into a live tab and deletes page `localStorage` and `sessionStorage` entries based on server-provided rules. That behavior can forcibly alter authenticated sessions or attribution state on th…	17.22
7	Data Exfiltration	high	dist/scripts/bg.wp.js (line 29)	Although the extension presents itself as 'WinSafe VPN' (winsafe-vpn.ru), its core business logic communicates with undisclosed third-party domains: `mallbery.com` (fetches merchants, offers, coupons, activation confi…	15.50
8	Network Interception	high	dist/scripts/bg.wp.js (line 29)	When a user visits a merchant site, the extension blocks requests whose URLs contain `t_tid=` or `t_s=` across all resource types. These are standard affiliate/tracking parameters used by competing affiliate networks.…	15.50
9	Network Interception	high	dist/scripts/bg.wp.js (line 29)	The extension sets a PAC (Proxy Auto-Config) script that routes browser traffic through a server-controlled proxy, embedding the proxy's username and password directly in the PAC script data string. The PAC script tem…	15.50
10	Unauthorized Data Collection	high	dist/scripts/bg.wp.js (line 14809)	On install, the extension enumerates every installed extension/app via `chrome.management.getAll()` and sends the full ID list to its analytics backend. Collecting the user's installed extension inventory is a strong …	17.22
11	Unauthorized Data Collection	high	dist/scripts/bg.wp.js (line 23753)	The extension records visited page URLs with timestamps and batches them to a remote `/history` API. This is direct browsing-history collection and transmission, which is highly sensitive and unrelated to the minimum …	17.22
12	Unauthorized Data Collection	high	dist/scripts/bg.wp.js (line 29)	On installation, the extension calls `chrome.management.getAll()` to enumerate every extension installed in the user's browser, then transmits the full list of extension IDs as a JSON-serialised string to the analytic…	15.50
13	Network Interception	medium	dist/scripts/bg.wp.js (line 10388)	After enumerating cookies for visited merchant-related domains, the extension selectively deletes them with `chrome.cookies.remove()`. Targeted third-party cookie stripping is consistent with session tampering or affi…	17.22
14	Unauthorized Data Collection	medium	dist/scripts/bg.wp.js (line 29)	The extension reads all cookies for monitored domains using `chrome.cookies.getAll` and selectively deletes cookies via `chrome.cookies.remove` based on server-controlled allow-lists (`h[i]`). The cookie deletion logi…	15.50

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


fontello.commaterial	-	http://fontello.comMaterial
www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
npms.io	/search	https://npms.io/search?q=ponyfill.
analytics.savematik.com	-	https://analytics.savematik.com
pingapi.	-	https://pingapi.
chrome.google.com	/webstore/detail/	https://chrome.google.com/webstore/detail/
tinyurl.com	/y2uuvskb	https://tinyurl.com/y2uuvskb
bit.ly	/2kdckMn	http://bit.ly/2kdckMn

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


26.141.185.3	IPv4	-
3.135.246.134	IPv4	-
2.1.218.176	IPv4	-
158.131.243.243	IPv4	-

1.0 out of 5 · 2 most recent reviews

Text reviews

Positive

Negative

Открывает левые страницы в виде "рекламы", так что никому не советую ставить. Репорт за нарушение вдогонку.

Vladilen Demidov·11 Feb 2023

Откры��ает левые страницы в виде "ре��ламы", так что ником�� не советую ставить. Репор�� за нарушение вдогонку.

Vladilen Demidov·11 Feb 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

WinSafe - быстрый доступ к сайтам!

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 5 Versions14

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating