Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by bleepingcomputer.com
Screen recorder
Marketplace listing not found
Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 3 months ago
- Version
- v3.1.12
- Artifact
- SHA256 77D…8A6
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
Requested Permissions
12 permissionsAccess and modify data on every website you visit
Access your identity and sign-in tokens
Manage, modify, and monitor downloads
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality strong.
This screen recorder extension triggers 269 total findings, but the nature of these findings reveals a classic false positive pattern. The vast majority (265 findings) are classified as code-smell, which the CVEQ platform documents as expected noise from standard JavaScript patterns.
The eight findings labeled as malware-signature with high severity are actually known false positive YARA rules. The rules YARA--postinstall_persistence_mechanism, YARA--postinstall_crypto_operations, YARA--postinstall_obfuscation, and YARA--postinstall_network_communication match basic Node.js patterns (fetch, crypto, process operations) that appear in legitimate extensions. The rules YARA--NoUseWeakRandom, YARA--LocalStorageShouldNotBeUsed, and YARA--OriginsNotVerified are code-quality checks, not malware signatures. Crucially, all eight of these findings reference unknown_file as their source, indicating they were detected in bundled or minified code rather than specific suspicious files.
The three network findings all reference local asset fetches: assets/selfieSegmentation.js, assets/selfieSegmentation/selfie_segmentation.js, and assets/vendor/ffmpeg.min.js. These are legitimate library loads for screen recording functionality (selfie segmentation and FFmpeg video processing), not external data exfiltration or command-and-control communication. There are zero IoC findings, meaning no suspicious external domains were detected.
The manifest analysis finding flags the tabs permission, which is appropriate and expected for a screen recorder extension that needs to capture browser content. This is not a security concern in this context.
The developer identity (a Gmail address rather than a company) is a minor concern but not determinative. Many legitimate developers publish under personal email addresses. The extension name "Screen recorder" is generic and does not impersonate any well-known extension.
Strongest counterargument: A skeptic might argue that 269 findings with 265 marked as high severity indicates serious problems. However, the scoring system has documented biases where code-smell findings disproportionately inflate counts. The findings_summary explicitly shows "malware-signature":"0" and "malware":"0" in threat_indicators, confirming there are no actual malware signatures. The high-severity labels on code-smell rules are a platform artifact, not an indicator of actual malicious code. The extension performs exactly what it claims: screen recording with standard libraries and permissions.
Key Reasons
- 265 of 269 findings are code-smell (known false positive pattern)
- Malware-signature findings are postinstall_* and code-quality rules (documented FPs)
- All malware-signature findings reference unknown_file (bundled code)
- Network findings are local asset fetches, not external domains
- Zero IoC findings and zero obfuscation findings
False Positive Considerations
- postinstall_* YARA rules matching basic Node.js patterns
- Code-quality rules (NoUseWeakRandom, LocalStorageShouldNotBeUsed) mislabeled as malware-signature
- High finding count from bundled dependencies
- Score inflation from code-smell volume
Reviewed 2026-05-23; recommended action: suppress false positive; model confidence 85%.
Source Code Not Available
Source code is not available for this version of the extension.