Suspicious ^80% firefox 1 installs Download

Multi-Account Container Helper 1.4.1

Excessive permissions, new package

“Import proxy lists, automate creation of containers, and manage Firefox Multi Account Containers with direct proxy routing.”

Extension can proxy all browser trafficArchive contains Mozilla COSE digest manifest

SHA-256430e348def9adb91c3ad40f4fd48e8f35ec77f93d0ad1e8dbaef7c2a4f6a770b

URLhttps://addons.mozilla.org/firefox/downloads/file/5044355/multi_account_container_helper-1.4.1.xpi

MaleculeO₂(CoS)H₇(Br₉Cm₃Cr₂Db₁₃Os₂Po₂U₇)Md₃(Pm₅Si)

Evidence

Extension declares proxy authority manifest.json · lines 1–23

1{
"manifest_version": 2,
"name": "Multi-Account Container Helper",
"version": "1.4.1",
"description": "Creates and manages Firefox Multi-Account Containers.",
"icons": {
  "48": "icon48.png",
  "96": "icon96.png"
},
"permissions": [
  "contextualIdentities",
  "cookies",
  "proxy",
  "storage",
⋯9 lines

Uses browser.* namespace core APIs options.js · lines 1–10

1:43… bled";
2const proxiesEnabledCheckbox = document.getElementById("proxies-enabled");
3const status = document.getElementById("status");
4
5async function restoreSettings() {
6  const stored = await browser.storage.local.get(proxyFeatureSettingKey);
7  proxiesEnabledCheckbox.checked = stored[proxyFeatureSettingKey] === true;
8}
9
10proxiesEnabledCheck …

Invokes zero-argument function at module scope options.js · lines 19–27

19:57… ignments are retained but not used.";
20  } catch (error) {
21    status.textContent = `Error: ${error.message}`;
22  } finally {
23    proxiesEnabledCheckbox.disabled = false;
24  }
25});
26
27restoreSettings();

Reads DOM text content popup.js · lines 55–58

33… er.storage.local.get("pendingProxyFileName");
proxyFileStatus.textContent = proxyState.pendingProxyFileName
  ? `Ready to assign: ${proxyState.pendingProxyFileName}`
  : "No proxy CSV imported."; …

SOCKS5 protocol reference popup.js · lines 212–233

38… & result.tested > 1
      ? "WARNING: every proxy reported the same exit IP. Firefox may be reusing one authenticated " +
        "connection across containers because they share the same proxy host and port. Try SOCKS5 " +
        "if your provider supports it, or ask for a distinct host/port per session.\n"
      : "") +
    result.results
      .map(row =>
        `${row.group} (${row.host}:${row.port}): ${row.ok ? `OK - ${row.reportedIp || "IP not read"}` : `FAILED - ${row.reason}`}`
      )
      .join("\n"),
},
223];
224
225function createActionStatus(button) {
const card = button.closest(".card");
let message = card.querySelector(".action-status");
if (!message) {
  message = document.createElement("div");
  message.className = "action-status";
  message.setAttribute("role", "status");
  message.setAttribute("aria-live", "polite");
  message.id = `${card.querySelector("h2").id}-status`; …

Showing the top 5 files — 4 more files (29 regions) not shown.

No evidence locations were recorded for this file. Raw result