Play Games
From the RiskyPlugins AI security review of the observed evidence.
Analysis record
- Analysed
- 8 months ago
- Version
- v1.0.1
- Artifact
- SHA256 6BA…31F
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
6 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | postinstall crypto operations Cryptographic operations detected | 1 | _metadata/verified_contents.json | Risky Plugins Authors FP 30% |
| HIGH | NoUseWeakRandom When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information. As the Math.random() function relies on a weak pseudorandom number generator, this function should not be used for security-critical applications or for protecting sensitive data. In such context, a cryptographically strong pseudorandom number generator (CSPRNG) should be used instead. For more information checkout the CWE-338 (https://cwe.mitre.org/data/definitions/338.html) advisory. | 1 | background.js | FP 5% |
| HIGH | postinstall network communication Network communication detected | 1 | background.js | Risky Plugins Authors FP 30% |
| HIGH | postinstall file manipulation File system manipulation detected | 1 | background.js | Risky Plugins Authors FP 20% |
| HIGH | postinstall persistence mechanism Persistence mechanism detected | 1 | background.js | Risky Plugins Authors FP 20% |
| HIGH | postinstall file download File download activity detected | 1 | background.js | Risky Plugins Authors FP 30% |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
YARA Rules Matched
6 rulesAI Security Report
AI Security Review
Evidence context: threat category browser hijack; evidence quality moderate.
The extension "Play Games" exhibits clear browser hijacking behavior based on its published description. The description explicitly states: "Add Play Games extension to modify your Default Search to OnlineGamesSearch.com Powered by Yahoo." This is a definitive declaration of browser hijacking functionality—the extension's stated purpose is to replace the user's default search engine with a third-party monetized domain (OnlineGamesSearch.com). Browser hijacking is a well-documented PUP pattern that redirects user searches through affiliate networks for revenue generation.
The developer attribution raises additional concerns. The developer_name field contains only an email address ([email protected]) rather than an identifiable company or organization. Combined with the extremely low user count of 10, this indicates an anonymous publisher with minimal market presence. Legitimate extensions typically have verifiable developer identities and broader adoption.
The findings_by_category is empty, which means no code-level security findings were extracted. This could indicate the extension is minimal and doesn't trigger YARA rules, or the analysis may have incomplete coverage. However, the absence of technical findings does not negate the browser hijacking behavior explicitly described in the extension metadata.
Counterargument consideration: A skeptic might argue that without code-level findings, we cannot confirm malicious behavior, and the extension might simply be a legitimate search tool. However, the description itself is evidence—the extension openly declares it will modify the user's default search engine, which is the definition of browser hijacking behavior. Even if the code is clean, the functionality described is inherently a PUP pattern that degrades user experience by forcing unwanted search redirection. The combination of anonymous publishing, hijacking functionality, and minimal user adoption creates a risk profile consistent with browser hijackers, regardless of whether malware signatures were detected.
Key Reasons
- Description explicitly states extension modifies default search engine to OnlineGamesSearch.com
- Anonymous developer (email-only attribution)
- Browser hijacking is a documented PUP pattern
- Very low user count (10 users)
Reviewed 2026-04-25; recommended action: monitor; model confidence 72%.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
Search Online
[email protected]
View Package Tracking
[email protected]
Online Search
[email protected]
种草星球-TikTok爆单神器，商品自动提报采集邀评【永久免费】
[email protected]
Kindredly - A safer, private web for families
[email protected]
Open Headers
[email protected]