782127 - netloader.cc/run.js loaded into every page - suspect existence of malicious extension

Status: NEW

(Firefox :: Security, defect)

Description

[Zack Weinberg (:zwol)]

Attachment: suspicious javascript blob

I have been teaching people to optimize page-load time, and sometimes odd things come up in Firebug's Net panel.  For instance, one of the students reports that the canned site-to-be-optimized loads http://netloader.cc/run.js , which I know I didn't put there.  There's not a lot to be found about this site online, and I don't have time right now to try to figure out what the rather large minified JS blob tries to do, but I suspect that there exists a malicious extension that loads this blob into *every page*.  If so, we should identify and block it.

I'm attaching the JS blob.