Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by bleepingcomputer.com
Dark Mode Google Docs
Marketplace listing not found
Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 3 months ago
- Version
- v4.9.68
- Artifact
- SHA256 C97…D74
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
Requested Permissions
7 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality strong.
The Dark Mode Google Docs extension generates findings that appear concerning but align with documented false positive patterns. The four high-severity obfuscation findings all occur in locale files: _locales/ml/messages.json, _locales/fa/messages.json, _locales/te/messages.json, and _locales/kn/messages.json. These correspond to Malayalam, Farsi/Persian, Telugu, and Kannada languages. Zero-width Unicode characters in South Asian and Middle Eastern locale files are legitimate writing system characters required for proper text rendering, not code obfuscation or steganography.
Seven medium-severity network findings detect generic fetch and XMLHttpRequest calls in background.js, inject/index.js, and banner.js. These represent standard network activity without any specific suspicious domains flagged. Critically, no IoCs were detected—zero malicious domains, IP addresses, or known bad infrastructure appear in the extension's code. The network calls likely handle theme updates or basic analytics, which is normal for this extension category.
No malware signatures matched across any files. The manifest declares a tabs permission, which is necessary for a dark mode extension to inject CSS styles into web pages. This permission is expected behavior, not a security concern.
A skeptic might question why an extension with 500,000 users has an anonymous developer listed as [email protected] and displays high-severity findings. However, the obfuscation findings follow a documented false positive pattern in locale files for legitimate language support. There are no actual malware signatures, no suspicious domains, and the extension's functionality matches its stated purpose. The high user count without widespread reports of harm further supports benign behavior. Legitimate extensions frequently use email addresses for developer attribution rather than company names, especially for smaller projects.
This extension is a legitimate dark mode tool for Google Docs. The findings stem from known false positive patterns: zero-width characters in locale files and generic network call detections without malicious destinations. No evidence of credential theft, browser hijacking, malware delivery, or data exfiltration exists in the code.
Key Reasons
- All obfuscation findings are in locale files for South Asian/Middle Eastern languages—a documented false positive pattern
- Zero malware signatures detected across all files
- Zero IoC matches—no suspicious domains or infrastructure found
- Network findings are generic fetch calls without specific malicious destinations
- Tabs permission is expected for dark mode functionality
False Positive Considerations
- Zero-width Unicode characters in locale files (_locales/ml, fa, te, kn)
- Generic network call detections without suspicious domains
- High finding count driven by locale file obfuscation patterns
Reviewed 2026-05-23; recommended action: suppress false positive; model confidence 85%.
Chrome version history
Risk trend by version
4 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.