Security Alert: Confirmed Malware
World Clock Tab
ID: mlmiallflopehalopojgbffmlpdllcjf
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Payder LLCView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Enjoy your new World Clock Tab on every new tab
World Clock New Tab 🌎⌚️ Keep track of time around the world with this handy extension! Add clocks for your favorite cities to your new tab page, and always know what time it is, no matter where you are. ---------------------------------------------------------------------------------------------------- By clicking "Add to chrome", I accept and agree to installing the: World Clock Tab extension and setting chrome new tab search provider to Microsoft Bing as described by the service in terms of use https://world-clock-newtab.com/terms and Privacy Policy https://world-clock-newtab.com/privacy ---------------------------------------------------------------------------------------------------- Features: * Add clocks for any city in the world * Customize the size and position of the clocks * Sync your clocks across devices Easy to use: Just install the extension and start adding clocks! You can also customize the size and position of the clocks to match your preferences. Free and ad-free: World Clock New Tab is completely free to use and ad-free. So what are you waiting for? Install it today and start keeping track of time around the world! ---------------------------------------------------------------------------------------------------- For more information you can check our: Terms of Service https://world-clock-newtab.com/terms Privacy Policy https://world-clock-newtab.com/privacy About Us https://world-clock-newtab.com/about
On first install, a persistent 256-bit random UID is generated, stored in chrome.storage.local, and immediately transmitted to the developer-controlled domain world-clock-newtab.com as a query parameter. This constitutes covert installation tracking — the developer receives a unique, durable identifier for every user who installs the extension, tied to the install event, without any disclosure to the user.
function getUID() { return new Promise(function(res) { chrome.storage.local.get('_UID', function(data) { var UID = data['_UID']; if (!UID) { // E.g. 8 * 32 = 256 bits token var randomPool = new Uint8Array(32); crypto.getRandomValues(randomPool); var hex = '', i = 0; while (i < randomPool.length) { hex += randomPool[i].toString(16); ++i; } // E.g. db18458e2782b2b77e36769c569e263a53885a9944dd0a861e5064eac16f1a UID = hex; chrome.storage.local.set({ _UID: UID }, function() { res(UID); }); } else { res(UID); } }); });}chrome.runtime.onInstalled.addListener(function(details) { if (details.reason === "install") { getUID() .then(function(uid) { chrome.tabs.create({ url: 'https://world-clock-newtab.com/thankyou?uid=' + uid }); }); }});Every search query entered by the user is routed through the developer's own domain (world-clock-newtab.com) before any search engine sees it. This gives the developer full visibility into the user's search terms. Combined with the persistent UID mechanism in the background script, each search query can be correlated with a specific tracked user across sessions.
const r = o => { if (o.type === "click" || o.type === "keydown" && o.key === "Enter" && !o.shiftKey) if (e !== "") { const i = `https://world-clock-newtab.com/?q=${encodeURIComponent(e)}`; o.preventDefault(), window.location.replace(i) } else o.preventDefault()};The background script exposes the persistent tracking UID to any page context (including the new tab page) on request. Because the new tab page also issues outbound requests to world-clock-newtab.com (for search query routing), this listener provides a mechanism for the UID to be bundled with other user activity data and exfiltrated to the developer's server across sessions.
chrome.runtime.onMessage.addListener(function(req, sender, sendResponse) { if (req.prop === 'uid') { getUID() .then(sendResponse); return true; }});By severity
Versions scanned
Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.8.3 | 3 |
Files with findings
2 distinct paths — top paths by unique finding count:
- js/background.js2
- assets/index-b01418a8.js1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.