Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →
Also reported by malext.io, reddit.com
vyberr Domain Tools Power HUD
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 4 months ago
- Version
- v1.0.0
- Artifact
- SHA256 455…5F3
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
Requested Permissions
22 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
The manifest.json declares the tabs permission ("MANIFEST-SENSITIVE-PERM-TABS"), which allows the extension to read the URL of the active tab – a common requirement for a domain‑lookup tool that resolves the current site’s owner information. No other high‑risk permissions (e.g., cookies, webRequest, proxy) are present, and the code never attempts to modify browser settings or inject scripts into pages.
All network activity originates from explicit fetch calls in the lib/integrations folder. The virustotal.js:50 file contacts VirusTotal’s API, openai-brandability.js:44 queries OpenAI’s brandability endpoint, godaddy.js:38 reaches GoDaddy’s WHOIS service, urlscan.js:22 opens a Socket.IO channel to URLScan, and sedo.js:80 talks to the Sedo marketplace. Each of these findings is labeled "NET‑FETCH" or "NET‑SOCKET_IO" and points to well‑known, reputable services. No request is made to obscure or newly registered domains, and there is no evidence of data being sent to a third‑party server under the developer’s control.
The massive IoC count reported in the summary (100,209 entries) is a by‑product of the generic IoC extractor flagging every domain name embedded in the bundled libraries as a separate indicator. Because the extension bundles many open‑source helper modules (e.g., HTTP clients, URL parsers), the extractor mistakenly treats their internal references as suspicious IoCs. This pattern matches the documented false‑positive behavior for bundled dependencies and IoC extractor noise.
No obfuscation signatures are present, and the code does not contain any YARA matches for known malware families. The absence of malware‑signature and malware findings confirms that static analysis did not identify malicious payloads. The only elevated finding is the tabs permission, which is reasonable for a tool that shows domain data about the current page.
Counterargument: A skeptic might point to the sheer volume of external API calls as a privacy risk, arguing that the extension could be exfiltrating browsing history. However, each network request is hard‑coded to a specific service endpoint and includes only the domain name or a public identifier; there is no dynamic construction of URLs based on user data, nor any transmission of cookies or session tokens. Moreover, the extension does not request the cookies or webRequest permissions needed to harvest such data. Therefore, the privacy impact is limited to the intentional lookup of the active tab’s domain, which aligns with the extension’s declared purpose.
In summary, the codebase behaves as advertised: it enriches the user’s view of the current site by querying reputable domain intelligence APIs. The high IoC count is an artifact of analysis tooling rather than evidence of malicious activity.
Key Reasons
- Only legitimate API fetches (virustotal, openai, godaddy, urlscan, sedo) are observed
- No malicious signatures or obfuscation detected
- Tabs permission is the sole sensitive permission, appropriate for domain lookup
- High IoC count results from bundled dependencies, a known false‑positive pattern
- No proxy, hijack, or credential‑theft behavior
False Positive Considerations
- Massive IoC count from bundled third‑party libraries
- Generic network‑call findings flagged as IoCs
- No obfuscation or malware signatures present
- All external domains are reputable services
Reviewed 2026-05-25; recommended action: no action; model confidence 85%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Resume Reading After You Reopen a Tab
[email protected]
Text Field Auto-Save & Recover
[email protected]
种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]
100xBot
[email protected]