Suspicious ^80% firefox 1 installs Download

Multi-Account Container Helper 1.4.0

Excessive permissions, new package

“Import proxy lists, automate creation of containers, and manage Firefox Multi Account Containers with direct proxy routing.”

Extension can proxy all browser trafficArchive contains Mozilla COSE digest manifest

SHA-2563dba686e8e5a50537d8cb9f0a9e5a8530c3cfffa6b821a245c13f6f159522d90

URLhttps://addons.mozilla.org/firefox/downloads/file/5044311/multi_account_container_helper-1.4.0.xpi

MaleculeO₂(CoS)H₇(Br₉Cm₃Cr₂Db₁₃Os₂Po₂U₇)Md₃(Pm₅Si)

Evidence

Extension declares proxy authority manifest.json · lines 1–23

1{
"manifest_version": 2,
"name": "Multi-Account Container Helper",
"version": "1.4.0",
"description": "Creates and manages Firefox Multi-Account Containers.",
"icons": {
  "48": "icon48.png",
  "96": "icon96.png"
},
"permissions": [
  "contextualIdentities",
  "cookies",
  "proxy",
  "storage",
⋯9 lines

Uses browser.* namespace core APIs import.js · lines 4–17

4:55… roxies");
5
6function setStatus(message, state = "") {
7  status.textContent = message;
8  status.dataset.state = state;
9}
10
11async function restoreState() {
12  const stored = await browser.storage.local.get(["pendingProxyFileName", "popupState"]);
13  if (stored.popupState && stored.popupState.proxyType) {
14    proxyType.value = stored.popupState.proxyType;
15  }
16  if (stored.pendingProxyFileName) {
17    setStatus(`Previ …

Registers browser click event listener import.js · lines 17–25

17:93… lace it.`);
18  }
19}
20
21if (extensionConfig.proxiesEnabled) {
22  importButton.addEventListener("click", async () => {
23  const file = fileInput.files[0];
24  if (!file) {
25    setStatus("Choose a proxy CSV file first.", "er …

Reads DOM text content popup.js · lines 54–57

33… er.storage.local.get("pendingProxyFileName");
proxyFileStatus.textContent = proxyState.pendingProxyFileName
  ? `Ready to assign: ${proxyState.pendingProxyFileName}`
  : "No proxy CSV imported."; …

SOCKS5 protocol reference popup.js · lines 211–232

38… & result.tested > 1
      ? "WARNING: every proxy reported the same exit IP. Firefox may be reusing one authenticated " +
        "connection across containers because they share the same proxy host and port. Try SOCKS5 " +
        "if your provider supports it, or ask for a distinct host/port per session.\n"
      : "") +
    result.results
      .map(row =>
        `${row.group} (${row.host}:${row.port}): ${row.ok ? `OK - ${row.reportedIp || "IP not read"}` : `FAILED - ${row.reason}`}`
      )
      .join("\n"),
},
222];
223
224function createActionStatus(button) {
const card = button.closest(".card");
let message = card.querySelector(".action-status");
if (!message) {
  message = document.createElement("div");
  message.className = "action-status";
  message.setAttribute("role", "status");
  message.setAttribute("aria-live", "polite");
  message.id = `${card.querySelector("h2").id}-status`; …

Showing the top 5 files — 2 more files (23 regions) not shown.

No evidence locations were recorded for this file. Raw result