URGENT: SECURITY: New maintainer is probably malicious

**TLDR**: The old maintainer appears to have **sold** the extension to parties unknown, who have **malicious intent** to exploit the users of this extension in advertising fraud, tracking, and more. In v7.1.8 of the extension (published to the web store but NOT to GitHub), **arbitrary code was executed from a remote server**, which appeared to be used to commit a variety of tracking and fraud actions. After Microsoft removed it from Edge for malware, v7.1.9 was created without this code: that has been the code distributed by the web store since November, and it does not appear to load the compromised script. However, the malicious maintainer remains in control, however, and can introduce an update at any time. It further appears that, while v7.1.9 was what was listed on the store, those who had the hostile v7.1.8 installed **did NOT automatically receive the malware-removing update**, and continued running the hostile code until Google force-disabled the extension. **The Great Suspender has been removed from the Chrome Web Store. To recover your tabs, see issue #526, or continue reading** The code in the Github repository is currently safe, and the most recent tagged release happened before the transfer of ownership. To use that version, and avoid needing to finagle URL's, enable Chrome developer mode, download and extract a copy of the code, then navigate to your extensions menu and select 'Load Unpacked Extension'. Some others have had success simply pressing the

Posted by calumapplepie on Nov 3, 2020, 3:18 PM

Tags

• github (Sysadmin)

Related issues

• Custom games stuck on "finding server" for all european servers
• Feature request: add ACP (Agent Client Protocol) stdio JSON-RPC mode
• Forza Horizon 6 (2483190)
• Turn off integrated browser for default
• Weekly updates are too frequent
• [BUG] Max 20x plan: 100% usage after 2 hours of light work (5 commits, no agents)