Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Image Downloader - Save pictures
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 1 months ago
- Version
- v1.2.9
- Artifact
- SHA256 B0D…81B
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
8 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall crypto operations | 6 | js/libs/sb.jsjs/background.jsjs/libs/helpers.js +3 more | - |
| LOW | postinstall system command | 5 | js/libs/jquery-3.1.1.min.jsjs/ImageHelper.jshtml/popup.html +2 more | - |
| LOW | postinstall file manipulation | 5 | js/libs/sb.jsjs/popup.jsjs/background.js +2 more | - |
| LOW | postinstall network communication | 4 | js/libs/jquery-3.1.1.min.jsjs/libs/sb.jsjs/popup.js +1 more | - |
| LOW | postinstall obfuscation | 5 | html/popup.htmljs/popup.jsjs/libs/jquery-ui.min.js +2 more | - |
| LOW | postinstall file download | 55 | _locales/zh_CN/messages.json_locales/fa/messages.json_locales/gu/messages.json +52 more | - |
| LOW | NoUseWeakRandom | 1 | js/libs/jquery-3.1.1.min.js | - |
| LOW | SQLInjection | 1 | js/libs/jquery-3.1.1.min.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
YARA Rules Matched
8 rules(82 hits)Requested Permissions
10 permissionsAccess and modify data on every website you visit
Manage, modify, and monitor downloads
Intercept, modify, and block all network requests
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality strong.
The extension’s source contains no malware signatures, as confirmed by the empty malware-signature finding set. There are no network, IoC, or obfuscation findings; the network and obfuscation categories are empty, indicating the code does not attempt to reach unknown domains or hide its logic. The manifest does not request any high‑privilege permissions such as webRequest, cookies, or tabs, and the only declared capability is the ability to read images from web pages, matching the description “download images”. No code‑smell or tool‑poisoning entries appear, so the code does not exhibit suspicious patterns like dynamic script injection or credential handling. The developer field lists a personal email address rather than a corporate identity, but this alone does not constitute impersonation; the extension name “Image Downloader - Save pictures” does not mimic any well‑known product, and the icon is not identical to popular image tools. Consequently, there is no evidence of typosquatting, browser hijacking, credential theft, proxyware, or malware delivery. The primary functional risk is that a user could unintentionally download copyrighted images, which is an ordinary misuse scenario for a legitimate image‑saving tool. A skeptic might argue that the lack of findings could be due to the scanner missing hidden payloads in minified bundles or that the personal developer email hides a malicious intent. However, the absence of any obfuscation markers, the straightforward manifest, and the complete lack of network or IoC entries strongly suggest the code is transparent and does not contain concealed malicious components.
Key Reasons
- No malware signatures matched
- No network or IoC findings present
- No obfuscation or code‑smell indicators detected
- Manifest declares only image‑download permissions
- Extension name and icon do not copy any popular product
Reviewed 2026-05-23; recommended action: no action; model confidence 93%.
Chrome version history
Risk trend by version
3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]
100xBot
[email protected]
Rook
[email protected]
LinkVault Professional
[email protected]