Suspicious ^80% firefox 1 installs Download

Nexload Browser Integration 0.1.1

Excessive permissions, new package

“Send downloads and selected links to the Nexload desktop app for macOS.”

Extension can bridge all-site cookies to a native hostArchive contains Mozilla COSE digest manifest

SHA-256dc93c7ae6c9a37d2931127cd9fc7fcf9bc96325d5f58d70fa5e30b40fb930c06

URLhttps://addons.mozilla.org/firefox/downloads/file/5036982/nexload_browser_integration-0.1.1.xpi

MaleculeK(Li)O₅(Ca₂C₂CoI₂S₂)H₈(Br₇Cm₁₃Db₁₂FHfOs₄Po₃U₆)Md₄(PaPm₇Si)

Evidence

Extension requests cookies permission manifest.json · lines 1–40

1{
"manifest_version": 2,
"name": "Nexload Browser Integration",
"description": "Send downloads and selected links to the Nexload desktop app for macOS.",
"version": "0.1.1",
"icons": {
  "16": "icons/16.png",
  "32": "icons/32.png",
  "48": "icons/48.png",
  "128": "icons/128.png"
},
"permissions": [
  "contextMenus",
  "nativeMessaging",
  "tabs",
  "cookies",
  "storage",
  "downloads",
  "notifications",
  "<all_urls>"
],
"background": {
  "scripts": [
    "background.js"
  ]
},
"content_scripts": [
  {
    "matches": [
      "<all_urls>"
    ],
⋯9 lines

Firefox declares authentication data collection manifest.json · lines 50–62

7… wser_specific_settings": {
  "gecko": {
    "id": "[email protected]",
    "strict_min_version": "140.0",
    "data_collection_permissions": {
      "required": [
        "authenticationInfo",
        "browsingActivity",
⋯5 lines

Calls a parenthesized function expression background.js · lines 44–60

44:34… t().version || '0.0.0';
45  } catch (_) {
46    return '0.0.0';
47  }
48})();
49
50const MENU_ID = 'nexload-download';
51
52// Hard-blocked media hosts: never capture and never show capture UI for
53// these (and any subdomain). DRM bypass and YouTube downloading are out of
54// scope by policy.
⋯6 lines

Chromium extension resource file marker background.js · lines 72–75

72:62… filter misses them.
73// KEEP IN SYNC with SUPPORTED_FILEHOSTS in content.js (see host-list drift test).
74const SUPPORTED_FILEHOSTS = [
75  'rapidgator.net', 'rg.to', 'nitroflare.com', 'katfile.com', 'ddownl …

Anonfiles.com file hosting background.js · lines 85–93

85:26… 
86  'mediafire.com', 'mega.nz', 'mega.co.nz', 'zippyshare.com', 'anonfiles.com',
87  'gofile.io', 'pixeldrain.com', 'krakenfiles.com', 'sendspace.com',
88  'dropbox.com', 'drive.google.com', 'wetransfer.com',
89];
90
91function matchHostSuffix(host, suffixes) {
92  const h = cleanText(host).toLowerCase();
93  if (!h) return  …

No evidence locations were recorded for this file. Raw result