Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by bleepingcomputer.com
Spell Check
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 2 weeks ago
- Version
- v1.0.7
- Artifact
- SHA256 D0D…6D8
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
10 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 1 | 130.js | - |
| LOW | LocalStorageShouldNotBeUsed | 2 | extads-sdk.jspanel.js | - |
| LOW | postinstall file manipulation | 4 | 130.jsextads-sdk.jsbackground.js +1 more | - |
| LOW | postinstall crypto operations | 4 | _metadata/verified_contents.json130.jspanel.js +1 more | - |
| LOW | postinstall obfuscation | 4 | _locales/lt/messages.json_locales/sl/messages.json_locales/et/messages.json +1 more | - |
| LOW | postinstall network communication | 9 | _locales/de/messages.json_locales/en/messages.json_locales/da/messages.json +6 more | - |
| LOW | postinstall system command | 3 | background.jspanel.js130.js | - |
| LOW | postinstall file download | 3 | extads-sdk.jspanel.js130.js | - |
| LOW | SQLInjection | 1 | 130.js | - |
| LOW | NoUseWeakRandom | 1 | 130.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
Finding Categories
YARA Rules Matched
10 rules(32 hits)Requested Permissions
5 permissionsAI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
Spell Check is a grammar and spell-checking utility extension with a legitimate stated purpose. The evidence bundle reveals three high-severity obfuscation findings in locale files (fa/messages.json, kn/messages.json, te/messages.json), two medium-severity network findings in extads-sdk.js and panel.js, 29 IoC matches, and 32 code-smell findings. The critical question is whether any of these represent genuine security risk.
The obfuscation findings all trigger on OBFUSCATION-INVISIBLE_ZERO_WIDTH characters in locale files for Farsi, Kannada, and Telugu. These are not steganography or hidden payloads. Zero-width joiners (U+200D) and zero-width non-joiners (U+200C) are essential characters in South Asian and Middle Eastern scripts for correct text rendering and word formation. Their presence in .json locale files is expected and legitimate. This is a documented false-positive pattern in YARA scanning of internationalization resources.
The network findings in extads-sdk.js:22 and panel.js:1 report fetch operations. The endpoint list includes gmail.com, config.ext-ads.com, ethereal-expanse.com, bugs.webkit.org, reactjs.org, softoolhub.com, and tailwindcss.com. Most of these are infrastructure: reactjs and tailwindcss are bundled npm libraries, gmail.com is a default email provider reference, and webkit.org is a browser engine project. The presence of these domains in network findings reflects how bundled JavaScript libraries make initialization calls, not malicious data exfiltration. No specific credential-theft or browser-hijacking IoCs appear in the endpoint list.
The 29 IoC findings and 32 code-smell findings require context. Code-smell findings of this volume are typical in any real JavaScript extension and do not correlate with malicious intent — they capture things like env var references and common library patterns. The IoC count is high but involves known false-positive domains (CDN infrastructure, standard library repos) that automated extractors flag from minified code. Without specific suspicious domains or malware signatures, IoC count alone is noise.
The strongest counterargument is that config.ext-ads.com and ethereal-expanse.com sound potentially sketchy. However, the former is typical naming for an ad-serving partner SDK (many extensions use third-party ad networks for monetization), and the latter does not appear in the findings with any associated malicious behavior — it's simply listed as a network endpoint. With no malware signatures, no credential-access patterns, and no evidence of hijacking, these domain names alone do not constitute a threat indicator.
The extension has a named developer ([email protected]), 8000 users, and a stable version number (1.0.7), all consistent with a legitimate utility extension.
Conclusion: the findings are driven by expected false-positive sources: zero-width characters in locale files and bundled JavaScript patterns. No malware signatures or concrete malicious behavior indicators are present.
Key Reasons
- Zero-width characters in Farsi, Kannada, and Telugu locale files are standard script requirements, not obfuscation
- No malware signatures detected despite 66 total findings
- Network endpoints include legitimate domains (gmail.com, reactjs.org, tailwindcss.com) and CDN infrastructure
- Developer attribution present ([email protected]) with 8000 users and stable version history
- Code-smell findings are expected in minified JavaScript and do not indicate malicious intent
False Positive Considerations
- OBFUSCATION-INVISIBLE_ZERO_WIDTH in locale files (fa, kn, te) — legitimate writing system characters, not steganography
- 29 IoC findings with no malware signatures or specific suspicious domains
- 32 code-smell findings typical of JavaScript bundling
Reviewed 2026-09-29; recommended action: suppress false positive; model confidence 82%.
Chrome version history
Risk trend by version
3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Image Converter
[email protected]
YouTube Transcript Generator
[email protected]
PDF Sign
[email protected]
Find The Font
[email protected]
种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]