Is Apache Cordova online CordovaIDE safe?
Apache Cordova online CordovaIDE sends each top-level page URL and the previous URL to www.myandroid.org once a day.
On every top-level navigation the extension reads the tab's previous URL, and once per calendar day sends the current and previous URLs, hex-encoded, with a persistent random user id to www.myandroid.org. URLs ending in .apk or .apkx are reported on every occurrence. If the server replies 'OKOKOK', the extension opens a new tab on myandroid.org that carries the id and the encoded URL. An options setting can turn the reporting off, but it is on by default.
Who publishes itMyAndroid - no other listings under this identity
MyAndroid - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Add-on sends each visited URL and the prior one, hex-encoded, to myandroid.org
Code analysis shows the add-on sends a visited page address and the previous one, hex-encoded with a persistent random ID, to www.myandroid.org once per calendar day.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open a page in a tab, by typing a URL or following a link.
The background script sends that page address and the tab's previous address to www.myandroid.org.
Only the first navigation each calendar day sends.
Navigation listener and the daily fetch in myandrs.js
Same code; the file ships unminified
myandrs.jsasync function heldd() { var date = new Date(); var dx = date.toLocaleString("default", { day: "2-digit" }) - 1; var od = await getd(); if( od === dx ) return false; return true;}- filepath68747470733a2f2f6578616d706c652e636f6d2f7c7c7c68747470733a2f2f676f6f676c652e636f6d2f
Hex-encoded text of the visited URL, then '|||', then the tab's previous URL.
- uk3x9qv0m2a
Random 10-character ID generated once and kept in extension local storage.
- dx09
Two-digit day of the month used by the once-a-day gate.
- hex1
Flag stating the filepath value is hex-encoded.
- www.myandroid.org
Receives the hex-encoded URLs and user ID; its reply can trigger a new tab on the same site.
Decodes the filepath value of a request to a-ideapachecordova.php back into the two URLs.
- Node.js 18+
const hex = process.argv[2];const text = hex.match(/../g).map(h => String.fromCharCode(parseInt(h, 16))).join('');const [current, previous] = text.split('|||');console.log({ current, previous });- 1Copy the filepath value from the request.
- 2Run node decode_filepath.js <hex>.
- 3Read the two URLs.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every secure site you visit
https://*/*
Read and change your data on every site you visit
http://*/*
Store data in your browser
storage
See every page you navigate to, as you navigate to it
webNavigation
Where it sends data
Destinations our analysis observed Apache Cordova online CordovaIDE contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.myandroid.org
Apache Cordova online CordovaIDE sends data to www.myandroid.org. One other extension we have analysed sends data here.