FedEx Tracking

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

This extension presents as a FedEx tracking tool but exhibits classic browser hijacking behavior. The developer is listed as an anonymous email address ([email protected]) rather than FedEx or a verified company, which is the first red flag for an extension claiming to represent a major brand.

The core issue is revealed in the network findings: src/js/background.js:26 makes fetch calls that route through trackingnumbers.org domain, not FedEx's official infrastructure. Multiple IoC findings confirm this pattern, including https://trackingnumbers.org/admin-fedex/public/link?q= and https://trackingnumbers.org/admin-fedex/public/autosuggest?searchTerm=. These URL paths indicate the extension intercepts package tracking queries and redirects them through a third-party service rather than using FedEx's official APIs.

The path structure admin-fedex/public in these URLs is particularly telling—it suggests a third-party service masquerading as FedEx rather than legitimate FedEx infrastructure. This is a well-documented monetization pattern where extensions capture user traffic and redirect through ad-supported or data-collecting services.

Additional concerning findings include the cookie.name domain in the IoC list, which raises questions about cookie handling behavior. However, some findings are known false positives: the ::bef IPv6 fragment is a documented XIOC extractor artifact from minified JavaScript, and clients2.google.com/service/update2/crx is Google's standard Chrome extension update service.

The extension has 30,000 users despite the anonymous publisher, suggesting this is a monetized extension that has been operating for some time. The absence of malware signatures and obfuscation findings indicates this is not traditional malware, but rather a PUP/browser hijacker that monetizes user traffic through third-party redirect services.

Counterargument: A skeptic might argue this is simply a legitimate third-party tracking aggregator that provides value by consolidating multiple carriers. However, the extension's name "FedEx Tracking" creates an expectation of official FedEx functionality, which it does not deliver. The key distinction is that legitimate third-party services are transparent about their nature, while this extension's presentation and domain routing pattern match known browser hijacking behavior where user intent is intercepted and monetized through redirect infrastructure rather than providing direct service.

Key Reasons

• Extension claiming FedEx functionality routes through third-party trackingnumbers.org domain instead of official FedEx infrastructure
• Anonymous developer email ([email protected]) for extension claiming to represent major brand
• Network calls in src/js/background.js:26 route queries through non-FedEx domain
• URL path structure admin-fedex/public indicates third-party service masquerading as FedEx
• 30,000 users suggests established monetization pattern despite anonymous publisher

False Positive Considerations

• IPv6 fragment ::bef is XIOC extractor artifact from minified JS
• clients2.google.com is Google's standard Chrome update service
• Code-smell findings (6 total) are expected noise from basic JS patterns

Reviewed 2026-05-23; recommended action: monitor; model confidence 85%.