Smooz Bookmark Extension
From the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 7 months ago
- Version
- v1.6.0
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
11 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | memory shylock | 4 | __MACOSX/image/logo/._edge_to_smooz.png__MACOSX/image/logo/._vivaldi_to_smooz.png__MACOSX/image/logo/._opera_to_smooz.png +1 more | https://github.com/jackcr/ FP 10% |
| HIGH | postinstall crypto operations Cryptographic operations detected | 3 | js/lib/jquery.min.jsjs/lib/sha1.js_metadata/verified_contents.json | Risky Plugins Authors FP 30% |
| HIGH | postinstall file download File download activity detected | 4 | __MACOSX/image/logo/._firefox_to_smooz.png__MACOSX/image/logo/._vivaldi_to_smooz.png__MACOSX/image/logo/._opera_to_smooz.png +1 more | Risky Plugins Authors FP 30% |
| HIGH | postinstall obfuscation Code obfuscation techniques detected | 3 | js/lib/jquery.min.jsjs/lib/sha1.jsjs/lib/oAuth.js | Risky Plugins Authors FP 20% |
| HIGH | SQLInjection SQL queries often need to use a hardcoded SQL string with a dynamic parameter coming from a user request. Formatting a string to add those parameters to the request is a bad practice as it can result in an SQL injection. The safe way to add parameters to a SQL query is to use SQL binding mechanisms. For more information checkout the CWE-564 (https://cwe.mitre.org/data/definitions/564.html) and OWASP A1:2017 (https://owasp.org/www-project-top-ten/2017/A1_2017-Injection.html) advisory. | 1 | js/lib/jquery.min.js | FP 10% |
| HIGH | credential env files Environment configuration file path detected | 1 | js/module/util.js | Risky Plugins Authors FP 10% |
| HIGH | NoUseWeakRandom When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information. As the Math.random() function relies on a weak pseudorandom number generator, this function should not be used for security-critical applications or for protecting sensitive data. In such context, a cryptographically strong pseudorandom number generator (CSPRNG) should be used instead. For more information checkout the CWE-338 (https://cwe.mitre.org/data/definitions/338.html) advisory. | 2 | js/lib/jquery.min.jsjs/lib/oAuth.js | FP 5% |
| HIGH | postinstall network communication Network communication detected | 6 | js/background.jsjs/lib/jquery.min.jsjs/popup.js +3 more | Risky Plugins Authors FP 30% |
| HIGH | postinstall file manipulation File system manipulation detected | 5 | js/lib/twitter.jsjs/background.jsjs/lib/jquery.min.js +2 more | Risky Plugins Authors FP 20% |
| HIGH | postinstall environment access Environment variable access detected | 2 | js/popup.jsjs/module/util.js | Risky Plugins Authors FP 40% |
| HIGH | postinstall system command System command execution detected | 4 | js/background.jsjs/lib/jquery.min.jsjs/popup.js +1 more | Risky Plugins Authors FP 10% |
Publisher Evidence
Limited evidenceAstool Inc.
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Edge does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
YARA Rules Matched
11 rules(35 hits)AI Security Report
AI Security Review
Evidence context: threat category unknown malware; evidence quality moderate.
The Smooz Bookmark Extension presents concerning signals that prevent a clear verdict. The most significant finding is the presence of 35 high-severity malware signatures across the codebase. Without details on which specific YARA rules triggered, these could represent either genuine malware or false positives from bundled dependencies. The file paths associated with findings include js/lib/twitter.js, js/iframe.js, js/module/user.js, and js/background.js, suggesting the signatures may be distributed across functional modules rather than concentrated in a single suspicious file.
The network findings are relatively benign: js/background.js:109, js/background.js:154, js/background.js:50, and js/popup.js:257 all trigger NET-JQUERY_AJAX detections, which are standard jQuery AJAX patterns used for legitimate HTTP requests. These do not indicate suspicious domain communication or data exfiltration.
Several metadata concerns warrant attention. The extension version is listed as unknown, which is unusual for published extensions and prevents proper version tracking. The user count is 0, indicating either a newly published extension or one that has been removed from the store. The developer "Astool Inc." is not a recognized publisher in the browser extension ecosystem.
The strongest counterargument to a malicious verdict is the absence of specific IoC domains, obfuscation markers, or credential theft patterns. The 35 malware signatures could stem from bundled third-party libraries triggering broad YARA rules, a documented false-positive pattern. Additionally, the network activity shows only standard jQuery calls rather than suspicious domain connections. However, the combination of high malware signature count, unknown version, zero users, and anonymous developer creates sufficient uncertainty to warrant follow-up analysis rather than dismissing as false positive.
Key Reasons
- 35 high-severity malware signatures detected without specific rule details
- Extension version listed as unknown
- Zero user count suggests new or removed extension
- Developer Astool Inc. is not a recognized publisher
- No specific suspicious IoC domains or obfuscation detected
False Positive Considerations
- Bundled dependencies may trigger multiple malware signatures
- Metadata hash findings are informational only
- jQuery AJAX network calls are benign patterns
Reviewed 2026-05-03; recommended action: runtime analysis; model confidence 60%.
Source Code Not Available
Source code is not available for this version of the extension.
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace