Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by bleepingcomputer.com
Image Converter
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 2 weeks ago
- Version
- v1.7
- Artifact
- SHA256 AFF…DAA
- Source
- Findings (non-IoC)
Is Image Converter safe?
Image Converter is a format conversion tool that declares no special permissions and lists no network endpoints in its manifest. The scanner flagged a network call in extads-sdk.js:22:0 named NET-FETCH-extads-sdk.js-22, which would indicate contact with an advertising SDK if real, but no domain or URL was recovered from that file. It also raised six obfuscation alerts. Three of them, OBFUSCATION-INVISIBLE_ZERO_WIDTH in _locales/fa/messages.json, _locales/kn/messages.json, and _locales/te/messages.json, fire on zero-width characters that are legitimate parts of the Farsi, Kannada, and Telugu scripts. The other three, FUNCTION_INDIRECT and DYNAMIC_EVAL in assets/js/cecfbf329b267234a175.js and ff104775bb64f0a81f9b.js, appear in minified JavaScript where bundlers routinely produce those patterns. Because the extension requests no permissions, the ad SDK code cannot reach the network, and the obfuscation alerts are known false positives from language files and build artifacts, the findings do not indicate malicious behavior.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
Requested Permissions
5 permissionsAccess and modify data on every website you visit
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The extension declares no permissions and no host permissions, and the network_endpoints array is empty. The single network finding NET-FETCH-extads-sdk.js-22 points to extads-sdk.js:22:0, a file name that suggests an advertising SDK, but no actual domains or URLs were extracted from that call site. The six obfuscation findings split into two groups. Three are OBFUSCATION-INVISIBLE_ZERO_WIDTH in _locales/fa/messages.json, _locales/kn/messages.json, and _locales/te/messages.json. These locale files contain Farsi, Kannada, and Telugu translations, and the zero-width joiner and non-joiner characters flagged by the scanner are required characters in those writing systems, not steganography. The remaining three findings — OBFUSCATION-FUNCTION_INDIRECT and two OBFUSCATION-DYNAMIC_EVAL in assets/js/cecfbf329b267234a175.js:2:0 and ff104775bb64f0a81f9b.js:1:0 — appear in minified or bundled JavaScript where indirect calls and eval-like patterns are common artifacts of bundlers such as webpack or esbuild. No malware signatures, no credential theft indicators, no browser hijack domains, and no credential-related findings appear in the bundle. The developer email [email protected] is a personal address but the extension has zero users and version 1.7, consistent with a new or low-distribution utility. The high finding count (7 total, 6 obfuscation) is driven by known false-positive patterns: locale-script characters misclassified as invisible obfuscation and bundler artifacts misclassified as dynamic evaluation. A skeptic would note the ad SDK file name and the medium-severity network finding, but without extracted endpoints or any permission to make network requests, that code path cannot execute in the browser. The evidence points to scanner noise, not malicious behavior.
Key Reasons
- Zero-width characters in locale files are legitimate script components
- Obfuscation findings in minified/bundled JS are bundler artifacts
- No permissions declared, so network code cannot execute
- No malware signatures, credential theft, or hijack indicators
- Finding profile matches known CVEQ false-positive patterns
False Positive Considerations
- OBFUSCATION-INVISIBLE_ZERO_WIDTH in locale files for Farsi/Kannada/Telugu
- OBFUSCATION-FUNCTION_INDIRECT and DYNAMIC_EVAL in minified/bundled JS
- Network finding with no extracted endpoints
- Zero users, new version, personal developer email
Reviewed 2026-09-30; recommended action: suppress false positive; model confidence 82%.
Chrome version history
Risk trend by version
3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Spell Check
[email protected]
YouTube Transcript Generator
[email protected]
PDF Sign
[email protected]
Find The Font
[email protected]
种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]