{"action":"closed","issue":{"url":"https://api.github.com/repos/ParticleCore/Iridium/issues/566","repository_url":"https://api.github.com/repos/ParticleCore/Iridium","labels_url":"https://api.github.com/repos/ParticleCore/Iridium/issues/566/labels{/name}","comments_url":"https://api.github.com/repos/ParticleCore/Iridium/issues/566/comments","events_url":"https://api.github.com/repos/ParticleCore/Iridium/issues/566/events","html_url":"https://github.com/ParticleCore/Iridium/issues/566","id":359665614,"node_id":"MDU6SXNzdWUzNTk2NjU2MTQ=","number":566,"title":"Malicious browser extension attempting to pass as Iridium","user":{"login":"sm-Fifteen","id":516999,"node_id":"MDQ6VXNlcjUxNjk5OQ==","avatar_url":"https://avatars1.githubusercontent.com/u/516999?v=4","gravatar_id":"","url":"https://api.github.com/users/sm-Fifteen","html_url":"https://github.com/sm-Fifteen","followers_url":"https://api.github.com/users/sm-Fifteen/followers","following_url":"https://api.github.com/users/sm-Fifteen/following{/other_user}","gists_url":"https://api.github.com/users/sm-Fifteen/gists{/gist_id}","starred_url":"https://api.github.com/users/sm-Fifteen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sm-Fifteen/subscriptions","organizations_url":"https://api.github.com/users/sm-Fifteen/orgs","repos_url":"https://api.github.com/users/sm-Fifteen/repos","events_url":"https://api.github.com/users/sm-Fifteen/events{/privacy}","received_events_url":"https://api.github.com/users/sm-Fifteen/received_events","type":"User","site_admin":false},"labels":[{"id":654805366,"node_id":"MDU6TGFiZWw2NTQ4MDUzNjY=","url":"https://api.github.com/repos/ParticleCore/Iridium/labels/announcement","name":"announcement","color":"000000","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2018-09-12T21:49:46Z","updated_at":"2018-10-08T18:23:19Z","closed_at":"2018-10-08T18:23:19Z","author_association":"NONE","body":"Hi, I'm not an Iridium user myself, but just thought I should let you know that I've had a fake browser update popup attempting to install a firefox extension on my browser. I've reported the website in question to Mozilla and downloaded the XPI to see what kind of extension this was, and the manifest and iridium.user files linked back here, so it appears parts of it were reused from the code of your extension, but the permissions are off and the code for ij.js and background.js is heavily obfuscated.\r\n\r\n```json\r\n{\r\n    \"manifest_version\" : 2,\r\n    \"name\" : \"Iridium\",\r\n    \"version\" : \"0.2.1\",\r\n    \"description\" : \"YouTube with more freedom\",\r\n    \"default_locale\" : \"en\",\r\n  \r\n    \r\n    \"background\": {\"scripts\": [\"js/background.js\"]},\r\n\t\r\n    \"content_scripts\" : [{\r\n            \"matches\" : [\"<all_urls>\"],\r\n            \"js\" : [\"js/ij.js\"],\r\n            \"css\" : [\"css/Iridium.css\"],\r\n            \"run_at\" : \"document_start\"\r\n    }],\r\n\r\n    \"permissions\" : [\"storage\",\"tabs\",\"webRequest\",\"webRequestBlocking\",\"activeTab\",\r\n                    \"<all_urls>\",\"http://*/*\", \"https://*/*\",\r\n                    \"unlimitedStorage\", \"cookies\"\r\n    ]\r\n}\r\n```\r\n\r\nI'm not entirely sure if I should link to the malicious website in question, but I can probably at least attach the XPI file in question. \r\n\r\n[ww.zip](https://github.com/ParticleCore/Iridium/files/2376971/ww.zip)\r\n\r\nI've taken the time to deobfuscate the content script by hand, and it definitely doesn't seem like the code on your github repository to me.\r\n\r\n[ij-malicious.js.txt](https://github.com/ParticleCore/Iridium/files/2376976/ij-malicious.js.txt)\r\n\r\nI don't know if the maintainer(s) of this project can really do anything about this, but I figured they'd want to know about this."}}
{"actor":{"display_login":"ParticleCore"}}