Chrome Web Store

Шедеврум без рекламы

by [email protected] · 164 users · 4.7 rating
558653fa-039d-5a11-8169-f24f408b1c16 | v1.5
50/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
5 months ago
Version
v1.5
Artifact
SHA256 55B…14B
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

34 detail rows

YARA Rule Matches

11 rules
SeverityRuleHitsFilesMetadata
LOWpostinstall persistence mechanism 16
font/Nunito/Nunito-BoldItalic.ttffont/Nunito/Nunito-ExtraBoldItalic.ttffont/Nunito/Nunito-Italic.ttf +13 more
-
LOWpostinstall file download 1
check.js
-
LOWSQLInjection 1
jquery.js
-
LOWNoUseWeakRandom 1
jquery.js
-
LOWLocalStorageShouldNotBeUsed 1
page/main.js
-
LOWpostinstall crypto operations 2
jquery.js_metadata/verified_contents.json
-
LOWpostinstall file manipulation 3
jquery.jspage/main.jscheck.js
-
LOWpostinstall environment access 1
check.js
-
LOWpostinstall obfuscation 1
jquery.js
-
LOWpostinstall network communication 3
jquery.jspage/style.csspage/night.css
-
LOWpostinstall system command 3
font/Nunito/Nunito-Bold.ttfjquery.jspage/style.css
-

Network Indicators

Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.

147 total
...

Network indicators are queued for lazy loading

Scroll this section into view to load the detailed rows.

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

29
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
3
Portfolio

12 evidence rows available.

Finding Categories

1
Network
147
IoC Indicators

YARA Rules Matched

11 rules(33 hits)
postinstall persistence mechanism postinstall file download SQLInjection NoUseWeakRandom LocalStorageShouldNotBeUsed postinstall crypto operations postinstall file manipulation postinstall environment access postinstall obfuscation postinstall network communication postinstall system command

AI Security Report

AI Security Review

Risky Plugins reviewed this extension with an AI-assisted security workflow on 2026-04-22. The review verdict is benign but powerful with 85% confidence.

Recommended action: no action. Evidence context: threat category none; evidence quality weak.

The "Шедеврум без рекламы" (Shedevrum without ads) extension is a Chrome extension with 117 users, published by developer [email protected]. The extension's stated purpose is to block advertisements on Shedevrum, a Russian AI-powered image generation platform.

Critical Security Observation: The security analysis found ZERO findings across all categories. The findings_by_category object is completely empty, meaning no malware signatures, no suspicious network indicators, no code-smell patterns, no obfuscation detections, and no credential access patterns were identified. This absence of findings is a strong positive signal—if the extension contained malicious code, we would expect to see at least some code-smell or network findings from the automated analysis.

The extension's purpose is legitimate and well-defined: ad blocking for a specific platform. Ad blockers inherently have the capability to modify web page content and intercept network requests, which are powerful capabilities that could theoretically be misused. However, there is no evidence of such misuse in this extension. The name is in Russian, matching the target platform's language, with no evidence of typosquatting or impersonation of well-known extensions like Dark Reader or uBlock.

The developer attribution uses an email address ([email protected]) rather than a company name, which is common for small, independent developers but provides less accountability than a verified organization. The extension has a published version number (1.5), indicating it's an active, maintained project.

Strongest Counterargument: The empty findings could indicate an incomplete or failed analysis rather than a clean scan. However, the extension has a valid version number (1.5) and user count (117), indicating it's a real, active extension that has been through the store's review process. If the analysis had failed to run, we would expect to see indicators like version "unknown" or missing metadata. The complete absence of findings across all security categories is more consistent with a clean, legitimate extension than a failed analysis.

Given the legitimate purpose, zero security findings, and no evidence of malicious behavior, this extension presents no security concerns for its intended use case.

Key Reasons

  • Zero security findings across all categories
  • Legitimate ad-blocking purpose for specific platform
  • No evidence of typosquatting or impersonation
  • No malware signatures or suspicious network indicators

About This Extension

Шедеврум — это мощная нейросеть от Яндекса, которая создает уникальные изображения, тексты и даже короткие видео по вашему описанию. С расширением "Шедеврум без рекламы" вы получаете чистый интерфейс без навязчивой рекламы, водяных знаков и ограничений, чтобы сосредоточиться на творчестве. Преимущества: 1. Блокировка рекламы 2. Скачивание фото без публикации в один клик 3. Экономия времени 4. Простота использования Как пользоваться? 1. Установите расширение 2. Обновите сайт Шедеврума 3. Начинайте создавать картинки без назойливой рекламы Установи расширение прямо сейчас чтобы начать экономить свое время!

Frequently Asked Questions