Deal Finder
From the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 10 months ago
- Version
- v3.0.0
- Artifact
- SHA256 EA5…00C
- Source
- Findings (non-IoC)
No Findings
All security checks passed
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
11 evidence rows available.
No Threats Detected
This extension passed all security checks
AI Security Report
AI Security Review
Evidence context: threat category adware; evidence quality moderate.
The Deal Finder extension presents significant risk indicators consistent with adware or potentially unwanted program (PUP) behavior. The extension is published under a generic Gmail address ([email protected]) with no company attribution, which is a red flag for extensions claiming shopping/coupon functionality.
The 257 IoC findings are dominated by suspicious .top TLD domains including ae-k.top, c.y-k.top, k.top, a.current.top, r.current.top, and b.top. These domains are not legitimate CDN, analytics, or infrastructure providers. The .top TLD is frequently associated with affiliate marketing networks, ad injection services, and monetization schemes that can compromise user privacy through aggressive tracking and redirects. The presence of e.group and n.group further suggests affiliate or ad network infrastructure.
Network findings show fetch calls in assets/chunk-ca0b61ee.js, assets/chunk-e7865be5.js, and assets/chunk-652fc577.js. These chunk files are consistent with bundled JavaScript, but the fetch activity combined with the suspicious IoCs indicates the extension actively communicates with these affiliate/ad domains during operation.
No malware signatures were detected, and there is no obfuscation evidence. The 21 code-smell findings are low-severity noise per known CVEQ false-positive patterns. However, the absence of malware signatures does not rule out PUP behavior—adware and browser hijackers often operate without traditional malware signatures.
Counterargument consideration: A skeptic might argue these domains represent legitimate affiliate tracking for a coupon extension, which is a common business model. However, the combination of an anonymous developer, high volume of .top TLD domains (not standard affiliate networks), and the extension's shopping category creates a risk profile consistent with adware that monetizes user traffic through aggressive affiliate schemes. Legitimate coupon extensions from known companies (e.g., Honey, RetailMeNot) use identifiable corporate domains, not obscure .top TLD infrastructure. The evidence warrants a confirmed_risk verdict rather than dismissal as false positive.
Key Reasons
- 257 IoCs to suspicious .top TLD affiliate/ad domains (ae-k.top, k.top, a.current.top, etc.)
- Anonymous developer with generic Gmail address and no company branding
- Shopping extension category commonly associated with affiliate monetization
- No malware signatures or obfuscation but PUP/adware pattern present
- Low user count (249) limits community validation
False Positive Considerations
- code-smell findings are noise per CVEQ documentation
- network fetch in chunk files is expected for bundled JS
- no malware signatures detected
Reviewed 2026-04-30; recommended action: monitor; model confidence 72%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
VPN for Discord
[email protected]
种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]
100xBot
[email protected]
Rook
[email protected]