Hostile ^100% firefox 1 installs Download

NoobClaw Browser Assistant 2.0.8

Arbitrary code execution, cookie theft

“Connects Chrome to NoobClaw AI for browser automationNoobClaw Browser Assistant connects your Chrome browser to the NoobClaw AI desktop cli…”

Extension evaluates message code in page main worldAttribute breakout injects image onerror

SHA-256550f751150ac1e9dce7cb922f673cb44237f9ee8b8dfc4f34b282a24434b7f6c

URLhttps://addons.mozilla.org/firefox/downloads/file/5051059/noobclaw_browser_assistant-2.0.8.xpi

MaleculeK(Am)O₇(C₅Xe₂As₃Ca₂Co₂EuS)H₉(Br₁₁Cm₃₅Cr₂Db₂₉HfOs₆Po₆Ti₃U₁₄)Md₅(Pa₂Pm₉PtSi)

Evidence

NoobClaw browser assistant product name background.js · lines 1–4

1/**
* NoobClaw Browser Assistant — Background Service Worker
*
* Connects to NoobClaw desktop client via TWO HTTP-anchored transports.

Injects code through WebExtension scripting API background.js · lines 1874–1893

⋯5 lines
try {
  // Check if already injected
  const [result] = await chrome.scripting.executeScript({
    target: { tabId },
    func: () => window.__noobclaw_injected === true,
  });
  if (result?.result) return; // Already injected
  await chrome.scripting.executeScript({
    target: { tabId },
    files: ['content.js'],
  });
} catch (e) {
  // Already injected or restricted page (chrome://, edge://, etc.)
}
// Wait a bit fo …

Extension injects main-world script background.js · lines 2340–2350

56…  await resolveTab();
    const results = await chrome.scripting.executeScript({
      target: { tabId: tab.id },
      world: 'MAIN',
      func: (sel, clickOnce, requireVisible) => {
        let el = null;
        if (requireVisible) {
          const all = document.querySelectorAll(sel);
          for (const c of all) {
            if (c.getBoundingClientRect().width > 0) { el = c; break; }
        …

Registers a browser runtime message listener background.js · lines 4686–4697

⋯6 lines
4692
4693// Listen for messages from popup
4694chrome.runtime.onMessage.addListener((msg, sender, sendResponse) => {
4695  if (msg.type === 'get_status') {
4696    // v1.x: Firefox 上 WS/SSE 断开经常不触发 onclose,SW 里 cached connected=true
4697    // 但 transport 真死了 → popup 显示绿色但实际连不上。修:Firefox 主动� …

Attribute breakout injects image onerror popup.html · lines 153–162

38… ; align-items:center; gap:6px; }
154</style>
155</head>
156<body class="loggedout">
<div class="brandrow">
  <img class="brandlogo" src="icons/icon48.png" onerror="this.style.display='none'">
  <span class="brandname">NoobClaw</span>
  <span class="tag" data-i18n="tagTrial">体验版</span>
  <div id="acctMini" class="acctmini" hidden>
    <span id="dot" class="cdo …

Showing the top 5 files — 2 more files (31 regions) not shown.

No evidence locations were recorded for this file. Raw result