Reddit Search
From the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 7 months ago
- Version
- v1.0.2
- Artifact
- SHA256 4E7…AC0
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
8 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall file download | 4 | popup.htmlpopup.jsjs/event-tracker.js +1 more | - |
| LOW | NoUseWeakRandom | 3 | js/user-identification.jsjs/event-tracker.jsbackground-service-worker.js | - |
| LOW | postinstall crypto operations | 4 | js/user-identification.jsjs/event-tracker.jsbackground-service-worker.js +1 more | - |
| LOW | postinstall file manipulation | 3 | js/user-identification.jsbackground-service-worker.jsjs/cookie-integration.js | - |
| LOW | postinstall obfuscation | 1 | popup.js | - |
| LOW | postinstall network communication | 3 | js/event-tracker.jsbackground-service-worker.jspopup.js | - |
| LOW | postinstall system command | 5 | popup.htmljs/user-identification.jsjs/event-tracker.js +2 more | - |
| LOW | postinstall persistence mechanism | 1 | background-service-worker.js | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
YARA Rules Matched
8 rules(24 hits)Requested Permissions
7 permissionsAI Security Report
AI Security Review
Evidence context: threat category browser hijack; evidence quality strong.
The "Reddit Search" extension exhibits clear browser hijacking behavior through its network connections to known hijacker domains. The extension's description claims to "See related Reddit discussions while you search," but the IoC findings reveal connections to blpsearch.com (findings: XIOC-URL-https://www.blpsearch.com, XIOC-URL-https://www.blpsearch.com/uninstall?extid=, XIOC-URL-https://www.blpsearch.com/uninstall/';, XIOC-URL-https://www.blpsearch.com/favicon.ico), a domain associated with search hijacking and PUP distribution. The presence of an uninstall endpoint with extension ID parameters is a hallmark of browser hijacker behavior designed to persist despite user removal attempts.
Additional suspicious domains include expldata.com and www.expldata.com (findings: XIOC-DOMAIN-expldata.com, XIOC-DOMAIN-www.expldata.com), which appear to be data collection endpoints unrelated to the extension's stated Reddit functionality. The popup.js:90 network finding confirms active fetch calls are being made from the extension's popup interface, indicating these domains are actively contacted during user interaction.
Several IoC findings represent known false-positive patterns from the XIOC extractor. Domains like data.data, item.data, and card.target (findings: XIOC-DOMAIN-data.data, XIOC-DOMAIN-item.data, XIOC-DOMAIN-card.target) are property access chains misinterpreted as domain names, not actual network destinations. Similarly, https://clients2.google.com/service/update2/crx is a legitimate Google Chrome update service endpoint, and https://search.yahoo.com/search?p= could be a legitimate search integration.
The strongest counterargument to this verdict would be that the extension legitimately integrates search functionality and the IoC count (52) is inflated by false positives. However, the presence of blpsearch.com with its uninstall endpoint is not a false positive—this is a documented browser hijacker domain. The generic developer email [email protected] instead of a company name, combined with only 2 users and no verification, indicates a low-quality or malicious extension. The 24 code-smell findings are noise and should not influence the verdict, as they trigger on almost any non-trivial JavaScript.
The extension's actual behavior—connecting to known hijacker domains while claiming Reddit functionality—constitutes browser hijacking, regardless of the false-positive IoC volume. Users installing this extension would have their search results redirected to hijacker-controlled domains, potentially exposing them to malicious redirects, unwanted advertisements, and data collection through expldata.com.
Key Reasons
- Connection to known browser hijacker domain blpsearch.com
- Uninstall endpoint with extension ID parameters indicates PUP persistence
- Generic developer email [email protected] instead of company name
- Data collection domain expldata.com unrelated to stated Reddit functionality
- Network fetch calls from popup.js confirm active domain communication
False Positive Considerations
- Property access chains misread as domains (data.data, item.data, card.target)
- Code-smell findings (24 total) trigger on any non-trivial JavaScript
- Google Chrome update service URL is legitimate infrastructure
- Yahoo search URL could be legitimate search integration
Reviewed 2026-04-28; recommended action: takedown request; model confidence 85%.
Chrome version history
Risk trend by version
2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace