Luffy meditation in beach

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

This extension presents significant risk factors typical of browser hijacking behavior. The description explicitly states it will "Transform your new tab," which is the hallmark of new tab page hijacking—a technique used to redirect users to monetized content or ad networks.

The developer identity is anonymous, using only a Gmail address ([email protected]) with no verifiable company or brand attribution. This is a red flag for extensions that modify browser behavior, especially new tab pages.

The IoC findings reveal concerning domain references beyond standard infrastructure. While Google domains (drive.google.com, mail.google.com, sheets.google.com, maps.google.com, youtube.com) and the false-positive "date.now" (JavaScript code misread as a domain by the XIOC extractor) are benign, the extension also references el.style.top, note.dataset.id, note.style.top, and data.top. These are not standard CDN, analytics, or legitimate service domains. The .style.top and .dataset.id TLDs are particularly suspicious for a meditation extension, suggesting potential ad injection or data exfiltration endpoints.

The network finding at js/popup.js:29 shows fetch activity, though the specific destination is not revealed in this finding. Combined with the suspicious domains, this indicates the extension makes external network calls beyond what a simple new tab page should require.

Critically, there are zero malware signatures, zero obfuscation findings, and zero code-smell findings. This is unusual for a truly malicious extension and suggests the code is not actively hiding malicious payloads. However, the absence of malware signatures does not rule out PUP behavior or browser hijacking.

Strongest counterargument: A skeptic might argue this is a legitimate meditation extension that simply embeds third-party services or analytics, and the high IoC count (481) is inflated by XIOC extractor false positives. The lack of malware signatures supports this view. However, the specific non-standard domains (.style.top, .dataset.id) combined with anonymous publishing and new tab page modification creates a pattern consistent with browser hijacking PUPs, regardless of whether the code contains traditional malware signatures.

With only 2 users, the extension has minimal impact, but the behavioral pattern warrants caution. Users should be aware this extension will replace their new tab page and communicates with unverified domains.

Key Reasons

• Anonymous Gmail developer account with no verifiable brand attribution
• New tab page modification behavior described in extension description
• Suspicious non-standard domains (el.style.top, note.dataset.id, note.style.top, data.top) in code
• Network fetch activity in js/popup.js:29 with unknown destination
• Zero malware signatures despite high IoC count suggests PUP rather than active malware

False Positive Considerations

• Google domain references (drive.google.com, mail.google.com, etc.) are likely benign code references
• date.now is JavaScript code misread as domain by XIOC extractor
• High IoC count (481) driven by XIOC extractor noise rather than actual malicious domains

Reviewed 2026-05-25; recommended action: monitor; model confidence 75%.