Zipline Search
Marketplace listing not found
Our last marketplace check could not find this listing in Chrome Web Store. It may have been removed or delisted. Existing installs may still run, but verify the publisher and package source before installing or updating.
From the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 7 months ago
- Version
- v0.1.0
- Artifact
- SHA256 24C…912
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
6 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | postinstall crypto operations Cryptographic operations detected | 1 | _metadata/verified_contents.json | Risky Plugins Authors FP 30% |
| HIGH | LocalStorageShouldNotBeUsed Session storage and local storage are HTML 5 features which allow developers to easily store megabytes of data client-side, as opposed to the 4Kb cookies can accommodate. While useful to speed applications up on the client side, it can be dangerous to store sensitive information this way because the data is not encrypted by default and any script on the page may access it. This rule raises an issue when the localStorage and sessionStorage API's are used. For more information checkout the OWSAP A3:2017 (https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure.html) advisory. | 1 | keepit-overlay.js | FP 5% |
| HIGH | postinstall network communication Network communication detected | 1 | keepit-overlay.js | Risky Plugins Authors FP 30% |
| HIGH | postinstall file manipulation File system manipulation detected | 2 | keepit-overlay.jspackage-extension.sh | Risky Plugins Authors FP 20% |
| HIGH | postinstall environment access Environment variable access detected | 1 | installed.js | Risky Plugins Authors FP 40% |
| HIGH | postinstall system command System command execution detected | 4 | README.mdpackage-extension.shinstalled.css +1 more | Risky Plugins Authors FP 10% |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
YARA Rules Matched
6 rules(10 hits)AI Security Report
AI Security Review
Evidence context: threat category browser hijack; evidence quality moderate.
Zipline Search is a browser hijacking extension that redirects user searches to a custom domain with extensive tracking capabilities.
Browser Hijacking Evidence: The extension implements search provider functionality through multiple endpoints in go.ziplinesearch.com. The finding XIOC-URL-https://go.ziplinesearch.com/query?q= establishes the primary search query handler. Additional findings reveal tracking for user lifecycle events: XIOC-URL-https://go.ziplinesearch.com/query?source=ext_install tracks installations, while XIOC-URL-https://go.ziplinesearch.com/query/ext/uninstalled.html?source=ext_uninstall tracks uninstallations. The omnibox integration via XIOC-URL-https://go.ziplinesearch.com/query?source=ext_omnibox&q= confirms address bar search hijacking.
Developer Attribution Concerns: The developer is listed as [email protected], an email address rather than a verified company name or organization. This anonymous attribution pattern is common in browser hijacking extensions that avoid accountability.
False Positive Analysis: The XIOC-IP-:: finding is an IPv6 fragment false positive from the XIOC extractor. The clients2.google.com and www.w3.org findings are benign infrastructure and namespace URLs. The 10 malware-signature findings with 0 actual malware detections indicate these are likely broad pattern matches rather than confirmed malicious code.
Counterargument: A skeptic might argue the extension is a legitimate custom search provider, as search extensions legitimately redirect queries. However, the combination of anonymous developer attribution, extensive tracking endpoints for install/uninstall events, and the response.show domain finding (a known adware-related domain pattern) distinguishes this from legitimate search extensions like those from DuckDuckGo or StartPage. Legitimate search providers use company-branded developer accounts and do not track uninstall events for analytics.
Conclusion: This extension exhibits confirmed browser hijacking behavior with tracking infrastructure. Users installing this extension will have their searches redirected to ziplinesearch.com with their activity tracked across install, query, and uninstall events.
Key Reasons
- Search redirector with custom query endpoint at go.ziplinesearch.com/query?q=
- Tracking endpoints for install/uninstall events indicate PUP behavior
- Anonymous developer attribution (email address only)
- Omnibox integration hijacks address bar searches
- response.show domain finding associated with adware patterns
False Positive Considerations
- IPv6 fragment :: detected as IoC
- Google infrastructure domains (clients2.google.com)
- W3C namespace URLs (www.w3.org)
- Malware-signature findings with zero actual malware detections
Reviewed 2026-04-29; recommended action: monitor; model confidence 75%.
Source Code Not Available
Source code is not available for this version of the extension.