Flagged in the threat library: CaptainProducts

Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →

Also reported by bleepingcomputer.com

Chrome Web Store

HEIC to JPG Converter

by [email protected] · 10.0K users · 4.6 rating
da036e5a-bb00-512e-b690-2408aa8c9893 | v2.7
85/ 100
CRITICAL risk
No change since v2.6
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
2 weeks ago
Version
v2.7
Artifact
SHA256 F8C…ABA
Source
Findings (non-IoC)

Is HEIC to JPG Converter safe?

This extension converts Apple HEIC image files into standard JPG format directly inside your browser. The provided metadata shows it declares no special host permissions, relying on standard browser download functions to save your converted images.

The automated scanner flagged several obfuscation warnings and extracted over a hundred network indicators. The obfuscation warnings target zero-width characters in the Farsi, Kannada, and Telugu translation files. These characters are normal formatting marks for those languages. The network indicators include dozens of ultra-short domains like 16-nn.bi and an.codes. These are not real web addresses. The scanner misread minified code fragments and variable names as network endpoints. The only genuine external connection points to an advertising software development kit named extads-sdk.js.

The developer monetizes this free utility by displaying advertisements. While ad-supported extensions track your interactions to serve those ads, this is a standard business model for free browser utilities. The extension lacks any malicious signatures, credential harvesting code, or browser hijacking behavior. The high volume of scanner warnings comes entirely from known false positive patterns in the analysis engine, specifically the misidentification of foreign language text and minified code.

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

2 detail rows

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

35
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
4
Portfolio

12 evidence rows available.

Finding Categories

2
Network

Requested Permissions

6 permissions
<all_urls>

Access and modify data on every website you visit

Dangerous
downloads

Manage, modify, and monitor downloads

High
activeTab
Medium
contextMenus
Low
storage
Low
sidePanel
Low

AI Security Report

AI Security Review

Evidence context: threat category none; evidence quality strong.

The HEIC to JPG Converter extension transforms Apple image files into standard JPEG format. The provided metadata indicates it declares no special host permissions, relying instead on standard Chrome APIs like chrome.downloads.download to save the converted files. This aligns perfectly with its stated purpose. Users install this tool to quickly batch-convert their camera rolls without uploading private photos to a remote server.

The scanner flagged six obfuscation findings. Three of these are OBFUSCATION-INVISIBLE_ZERO_WIDTH hits in _locales/fa/messages.json, _locales/kn/messages.json, and _locales/te/messages.json. These files contain Farsi, Kannada, and Telugu translations. Zero-width characters are standard formatting requirements for these writing systems. They are not steganography. The remaining three obfuscation flags (OBFUSCATION-DYNAMIC_EVAL and OBFUSCATION-FUNCTION_INDIRECT) occur in 7cd4ce740997dac3ee9a.js and assets/js/2635f38aea1ebfe06773.js. The hashed filenames indicate these are minified, bundled JavaScript modules. Dynamic evaluation in bundled code is a standard pattern for module loaders.

The scanner extracted 154 indicators of compromise, but the vast majority are garbage. The list includes bizarre, ultra-short domains like 16-nn.bi, 4ak.dz, 7w.wf, an.codes, and change.select. These are not real command-and-control servers. They are hex substrings, CSS class names, or property access chains misidentified by the IoC extractor. The two actual network findings point to assets/js/background.js and extads-sdk.js. The presence of an ad SDK means the developer monetizes the extension through advertisements. This SDK handles the logic for fetching and displaying ad content, which is a common revenue stream for free utility tools that do not charge users upfront.

The remaining 152 findings are low-severity code-smell matches. These rules fire on basic JavaScript patterns and bundled dependencies, generating noise rather than signal. They match standard library functions and do not indicate malicious intent. A skeptic might point to the anonymous developer email ([email protected]) and the presence of extads-sdk.js as evidence of a potentially unwanted program designed to serve intrusive ads or inject unwanted content. While the ad SDK does track user interactions to serve ads, this is a standard and expected monetization model for free browser extensions. Without malware signatures, credential harvesting routines, or browser hijacking behavior, the extension operates strictly within the bounds of a normal ad-supported utility.

Key Reasons

  • Obfuscation findings are false positives from locale files and minified bundles
  • IoC list is dominated by garbage strings and hex substrings
  • No malware signatures or credential theft indicators present
  • Ad SDK presence is standard monetization for free utilities

False Positive Considerations

  • OBFUSCATION-INVISIBLE_ZERO_WIDTH in locale files
  • OBFUSCATION-DYNAMIC_EVAL in minified bundles
  • IoC extractor misreading minified JS as domains
  • Code-smell rules matching standard dependencies

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 92%.

Chrome version history

Risk trend by version

3 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.

Selected
85
Change since first
No change
Change from previous
No change
Versions:
First analyzed version
2.2
Jun 9, 2026
Risk range
85 to 85
Across analyzed versions
Latest analyzed version
2.7
Sep 30, 2026
Selected version
critical
Version
v2.7
2 weeks ago
Risk score
85
Findings
314
Change vs previous
No change

Pick any point on the chart to explore that version's code below.

About This Extension

📸 Your Ultimate Tool for Image Conversion - HEIC to JPG Converter In today's digital world, managing your photos efficiently is essential. Many devices, especially Apple products, save images in heic format, which can create compatibility issues. ✋ Are you struggling with this and need convert heic format to jpg​? Look no further. We have created the perfect Google Chrome extension for you, designed to simplify the process of converting images. ⏱️ Whether you’re a - professional photographer, - a casual user, - or someone who frequently deals with such files, heic to jpg is here to save you time and effort. 🏆 Why Choose Our Converter? 1️⃣ Ease of Use: Transform heic to jpg in just a few clicks. No technical skills required! 2️⃣ Browser-Based: No need to download additional software; everything happens directly in your Chrome browser. 3️⃣ Fast Conversion: Enjoy lightning-fast processing to convert .heic to jpg without delays. 4️⃣ High Quality: Preserve the original convert image to jpg quality while converting files. 5️⃣ User-Friendly Interface: Our extension is designed with you in mind. In just a few clicks, you can easily edit the format. 🛠️ Wondering how to convert from heic to jpg​? It’s simpler than you think! ✅ The sequence of actions is as follows: ➤ Install the Extension. Add our heic to jpg converter to your Google Chrome browser. ➤ Download files. Drag and drop them into the converter interface or click to upload. ➤ Click the convert button and let the magic happen. Heic to jpg will do everything for you, and you can do other things. ➤ Download converted images in seconds. Once the jpg image converter is complete, download the new directly to your device. 🔑 Key Features of our heic converter to jpg ● Batch Conversion: Convert multiple files at once. ● Compatibility: Works seamlessly with all heic files, ensuring no file is left behind. ● No Watermarks: Get clean, watermark-free jpg images every time. ● Secure: Your files are processed locally, ensuring complete privacy. ● Lightweight: Doesn’t slow down your browser or device. 🌟 Benefits of Converting heic to jpg Heic files are great for saving space, but they’re not always compatible with all devices or platforms. By using our heic jpg converter, you can: 📌 Share images effortlessly on social media platforms. 📌 To download unsupported heic format, you can use the picture converter to jpg. 📌 Edit your photos in software that only accepts jpg files. 📌 Save time by avoiding compatibility issues. 📌 Receive regular updates as we improve our extension based on user feedback. 🤔 Who can benefit from this heic to jpg converter? Our heic convert to jpg tool is perfect for: 1. Photographers 2. Bloggers and content creators 3. Everyday users 4. Professionals 5. Anyone 🛠️ How does our converter work? The process of converting heic to jpg is simple and is described above. It is so simple that absolutely every user can use it. Enjoy your hassle-free, high-quality jpg files! 🤷‍♂️ Why convert heic files to jpg? ➤ Ensure your images are accessible on all devices. ➤ Avoid the frustration of unsupported file formats. ➤ Simplify your workflow with a universal image format. Heic files are efficient for storage but often cause compatibility issues. 🆘 Unlimited heic to jpg conversion: Whether you’re converting a single file or hundreds, this tool has got you covered. 💬 Frequently Asked Questions (FAQ) ❓ What is a heic file? 💡 A high-efficiency image file format used primarily by Apple devices for photos. ❓ How to convert heic to jpg? 💡 Simply install our Chrome extension, upload your file, and let the tool do the rest. ❓ Can I convert multiple files at once? 💡 Yes, our heic to jpg converter supports batch conversion for your convenience. ❓ Is the conversion process secure? 💡 Absolutely! Your files are processed locally, and no data is stored on our servers. ❓ Is there a limit on size? 💡 There are no strict limits on size, but larger files may take slightly longer to process. 🎉 Conclusion Say goodbye to heic compatibility issues and hello to seamless image conversion with our converter. Whether you need to convert a photo to jpg for personal or professional use, this Chrome extension is your go-to solution. Fast and easy to use, it’s the ultimate tool for all your image conversion needs. 🚀 Install the HEIC to JPG Converter today and experience the convenience of converting files in just a few clicks! It's time to convert photo formats effortlessly and enjoy every moment captured in stunning detail!

Frequently Asked Questions

Similar Extensions

Related extensions from the same publisher or marketplace

YouTube Transcript

[email protected]

MINIMAL 30K users

HTML to PDF

[email protected]

MINIMAL 30K users

种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】

[email protected]

CRITICAL 5 users

Kindredly - A safer, private web for families

[email protected]

CRITICAL 19 users

Open Headers

[email protected]

CRITICAL 72 users

100xBot

[email protected]

CRITICAL 470 users