Watch TV

AI Security Review

Evidence context: threat category pup; evidence quality strong.

The extension’s background.js:6 makes a fetch request, and lib/geoip2.js:89 issues an XMLHTTP request, confirming active network communication from the extension’s own scripts. More critically, a malware‑signature finding was reported (the only signature across all files), indicating that known malicious code matches content within the package. The description and new‑tab behavior – “replaces your new tab with online tv show streaming search & sponsored web search” – aligns with classic browser‑hijacking PUP patterns that monetize the new‑tab page. Numerous domain IoCs such as n.data, d.next, l.next, s.next, i.next, r.style, l.name, n.compare, ta.next, and na.next are reported by the XIOC extractor. While many of these resemble generic placeholder domains often generated by obfuscation tools, their presence in the IoC list reinforces that the extension contacts external servers beyond typical CDN or analytics endpoints. No evidence of credential theft or proxyware is observed; the risk stems from unwanted content injection and the detected malware signature.

Counterargument: A skeptic might argue that the single malware‑signature finding could be a false positive caused by bundled third‑party libraries, and that the domain IoCs are generic artifacts from minified code. However, the signature’s presence despite the lack of obfuscation flags it as a concrete match to a known malicious pattern, and the extension’s functional description explicitly states it alters the new‑tab page – a behavior that, combined with the signature, meets the high‑confidence criteria for malicious intent.

In summary, the combination of an explicit malware signature, network calls from core extension scripts, and the new‑tab replacement functionality warrants a confirmed malicious classification.

Key Reasons

• Malware‑signature finding present in the extension code
• Network requests initiated from background.js and lib/geoip2.js
• Extension replaces new tab with sponsored streaming search (browser hijack behavior)
• Multiple domain IoCs indicating external communication beyond usual CDNs

False Positive Considerations

• Generic XIOC domains often produced by minified code
• Code‑smell findings (low relevance)
• High total finding count inflated by bundled libraries

Reviewed 2026-05-23; recommended action: takedown request; model confidence 86%.