PureFind
From the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 7 months ago
- Version
- v1.0.1
- Artifact
- SHA256 A5C…BEC
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
7 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall crypto operations | 3 | js/event-tracker.jsjs/user-identification.js_metadata/verified_contents.json | - |
| LOW | postinstall file manipulation | 3 | js/user-identification.jsbackground-service-worker.jsjs/cookie-integration.js | - |
| LOW | postinstall network communication | 2 | js/event-tracker.jsbackground-service-worker.js | - |
| LOW | postinstall system command | 6 | js/brand.jsjs/event-tracker.jsjs/user-identification.js +3 more | - |
| LOW | postinstall file download | 2 | js/event-tracker.jsbackground-service-worker.js | - |
| LOW | NoUseWeakRandom | 2 | js/event-tracker.jsjs/user-identification.js | - |
| LOW | postinstall persistence mechanism | 1 | background-service-worker.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
YARA Rules Matched
7 rules(19 hits)Requested Permissions
5 permissionsRead and modify cookies on all sites
AI Security Report
AI Security Review
Evidence context: threat category browser hijack; evidence quality strong.
The PureFind extension exhibits clear browser hijacking behavior through search query redirection and analytics tracking. The IoC findings reveal search URLs pointing to blpsearch.com with tracking parameters: XIOC-URL-https://www.blpsearch.com/instant?source=ea_ext_yhs_1984_purefind&q= and XIOC-URL-https://www.blpsearch.com/search?source=ea_ext_yhs_1984_purefind&pc=EAPF&form=PF0001&q=. These URLs redirect user searches to an unknown monetized search engine rather than legitimate providers like Google or Bing, with parameters that identify this extension as the traffic source.
User activity tracking is confirmed through XIOC-DOMAIN-www.expldata.com and XIOC-URL-https://www.expldata.com/api/events, which transmit analytics data to an external domain. The presence of XIOC-DOMAIN-ns.attribution.com and XIOC-URL-http://ns.attribution.com/ads/1.0/ indicates ad attribution infrastructure, consistent with monetization through sponsored search results.
The developer attribution [email protected] uses a generic email address from a domain suggesting an ad network rather than a legitimate software company. The extension description explicitly states it performs "intelligent redirection and comprehensive analytics tracking," which directly describes the hijacking and surveillance behavior observed in the IoCs. Zero user count indicates this extension has not gained traction, which is consistent with unwanted software that users typically uninstall.
Several IoC findings are false positives from the XIOC extractor: XIOC-DOMAIN-date.now (JavaScript method), XIOC-DOMAIN-chrome.runtime.id (Chrome API), XIOC-DOMAIN-manifest.name (manifest property), and XIOC-DOMAIN-userparams.tg (property access chain). These represent 4 of 44 IoC findings and do not affect the verdict. The remaining IoCs reveal genuine malicious infrastructure.
A skeptic might argue the 65 total findings include noise from code-smell rules (19 findings) and that no malware signatures were detected. However, browser hijackers do not require malware signatures—they are unwanted programs that manipulate browser behavior. The absence of malware signatures does not indicate benign behavior when the extension's core functionality is search redirection to a monetized engine. The code-smell findings (severity=low) are classified as noise per CVEQ documentation and do not drive this verdict. The specific, non-generic domains blpsearch.com, expldata.com, and ns.attribution.com constitute strong evidence of intentional hijacking behavior, not false positives.
This extension should be escalated for potential store removal as it fundamentally alters user search behavior for monetization purposes.
Key Reasons
- Search redirection to unknown monetized engine blpsearch.com
- User activity tracking via expldata.com/api/events
- Ad attribution infrastructure at ns.attribution.com
- Generic developer email from ad network domain
- Description admits to redirection and analytics tracking
False Positive Considerations
- XIOC-DOMAIN-date.now (JavaScript method)
- XIOC-DOMAIN-chrome.runtime.id (Chrome API)
- XIOC-DOMAIN-manifest.name (manifest property)
- XIOC-DOMAIN-userparams.tg (property access chain)
Reviewed 2026-04-27; recommended action: escalate; model confidence 85%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace