Maps Hub Search

AI Security Review

Evidence context: threat category browser hijack; evidence quality strong.

This extension exhibits clear browser hijacking behavior. The description explicitly states it will make "geo-optimized Yahoo as your default search," and the extension name "Maps Hub Search" combined with the new tab functionality in js/mh_new_tab.js indicates it replaces the new tab page with search functionality. The network findings show fetch calls in js/bg/mh_background.js:221 and js/bg/mh_background.js:16, plus a jQuery AJAX call in js/mh_new_tab.js:101, which are typical patterns for search redirection extensions.

The 386 IoC findings are false positives from the XIOC extractor. Domains like slice.call, this.storage, b.using.call, and a.global are JavaScript property access chains being misread as domains. These match the documented "IoC Extractor Garbage" pattern where property access chains like b.call, h.next, g.id are incorrectly flagged. None of these represent actual network destinations.

There are zero malware signatures in this extension. The 35 code-smell findings are classified as low severity and match known noise patterns (basic Node.js patterns, API key references). No obfuscation was detected, and the developer email [email protected] lacks proper company attribution, which is common for PUPs but not inherently malicious.

Counterargument: A skeptic might argue the 428 total findings and "medium" severity ratings indicate serious risk. However, finding count is meaningless when 90%+ are XIOC false positives. The scoring system is known to inflate risk scores from IoC volume and code-smell counts. What matters is the NATURE of findings: zero malware signatures, zero obfuscation, and no suspicious domains beyond the property-access-chain garbage. The actual risk is the browser hijacking behavior itself—unwanted search redirection—not hidden malware or data theft.

This is a Potentially Unwanted Program (PUP) with browser hijacking capabilities. It's not malware, but it modifies browser behavior without clear user consent for the search engine change.

Key Reasons

• Browser hijacking behavior: changes default search to Yahoo via new tab page
• 386 IoC findings are XIOC false positives (property access chains misread as domains)
• Zero malware signatures detected
• Developer email lacks company attribution ([email protected])
• Network calls in background.js and new_tab.js are generic search redirection patterns

False Positive Considerations

• XIOC property access chain false positives (slice.call, this.storage, etc.)
• Code-smell findings from basic JavaScript patterns
• High IoC count from bundled code noise

Reviewed 2026-05-23; recommended action: monitor; model confidence 85%.