Safe Search
From the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 7 months ago
- Version
- v1.0.2
- Artifact
- SHA256 EC9…EA3
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
8 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | postinstall persistence mechanism | 1 | background-service-worker.js | - |
| LOW | postinstall file download | 3 | js/event-tracker.jspopup.jsbackground-service-worker.js | - |
| LOW | NoUseWeakRandom | 2 | js/event-tracker.jsjs/user-identification.js | - |
| LOW | postinstall crypto operations | 3 | js/event-tracker.jsjs/user-identification.js_metadata/verified_contents.json | - |
| LOW | postinstall file manipulation | 4 | popup.jsjs/user-identification.jsjs/cookie-integration.js +1 more | - |
| LOW | postinstall obfuscation | 1 | popup.js | - |
| LOW | postinstall network communication | 5 | popup.jspopup.htmljs/event-tracker.js +2 more | - |
| LOW | postinstall system command | 6 | popup.jsjs/brand.jspopup.html +3 more | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
YARA Rules Matched
8 rules(25 hits)Requested Permissions
9 permissionsRead and modify cookies on all sites
AI Security Report
AI Security Review
Evidence context: threat category browser hijack; evidence quality strong.
The "Safe Search" extension demonstrates clear browser hijacking behavior through its search domain configuration and data collection infrastructure. The IoC finding XIOC-URL-https://www.blpsearch.com/search?source=ea_ext_yhs_1984_safesearch&pc=EASS&form=SS0001&q= reveals the extension redirects user queries to blpsearch.com rather than legitimate search engines. This URL pattern with parameters like ea_ext_yhs_1984_safesearch and pc=EASS is characteristic of monetized search hijacking that redirects traffic to generate affiliate revenue.
The js/event-tracker.js:255 file contains network fetch calls that transmit data to expldata.com, as shown in the XIOC-DOMAIN-expldata.com finding. This event tracking infrastructure collects user browsing behavior beyond the extension's stated purpose of "enhancing Yahoo search." The MANIFEST-SENSITIVE-PERM-TABS finding confirms the extension requests the tabs permission in manifest.json, granting it access to all browser tabs—a capability far exceeding what a search enhancement tool requires.
The developer email [email protected] lacks verifiable company attribution, and the extension has only 4 users, suggesting it may be a newly deployed hijacker. The popup.js:264 network finding shows additional fetch calls from the extension's popup interface, indicating active data transmission during user interaction. The XIOC-URL-https://blpsearch.com/uninstall?extid= finding further confirms this is a managed hijacker with remote uninstall tracking.
Counterargument: A skeptic might argue that blpsearch.com could be a legitimate search partner and that the 25 code-smell findings are the real concern. However, code-smell findings are explicitly classified as noise per CVEQ guidelines and should never drive verdicts. Additionally, legitimate search partners would not use parameter patterns like ea_ext_yhs_1984_safesearch designed to track affiliate conversions, nor would they require tabs permission for search functionality. The absence of malware signatures does not mitigate the hijacking behavior—browser hijackers are PUPs (potentially unwanted programs) rather than traditional malware, yet they still harm users by redirecting searches and collecting data without informed consent.
The XIOC-DOMAIN-message.domains and XIOC-DOMAIN-t.dataset.target findings suggest additional telemetry endpoints. The XIOC-URL-https://clients2.google.com/service/update2/crx is benign (Google's CRX update endpoint) and should not influence the verdict. This extension exhibits intentional behavior that redirects user searches to monetized domains and collects browsing data through tracking infrastructure, all while requesting excessive permissions.
Key Reasons
- Search redirection to monetized domain blpsearch.com with affiliate tracking parameters
- Event tracking via js/event-tracker.js transmitting to expldata.com
- Excessive tabs permission in manifest.json for stated functionality
- Anonymous developer email [email protected] with no company attribution
- Remote uninstall tracking via blpsearch.com/uninstall endpoint
False Positive Considerations
- Google CRX update endpoint (clients2.google.com) is legitimate infrastructure
- Code-smell findings (25 total) are noise per CVEQ guidelines
Reviewed 2026-04-28; recommended action: escalate; model confidence 85%.
Chrome version history
Risk trend by version
2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace