Our analysis confirmed the behaviour described in the threat library entry. Read the analysis and indicators →
Also reported by esentire.com
Rewards Search Automator
Confirmed member of a tracked malicious supply-chain campaign.
Analysis record
- Analysed
- 8 months ago
- Version
- v1.6.5
- Artifact
- SHA256 ED0…4F2
- Source
- Findings (non-IoC)
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
18 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| HIGH | NoUseWeakRandom When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information. As the Math.random() function relies on a weak pseudorandom number generator, this function should not be used for security-critical applications or for protecting sensitive data. In such context, a cryptographically strong pseudorandom number generator (CSPRNG) should be used instead. For more information checkout the CWE-338 (https://cwe.mitre.org/data/definitions/338.html) advisory. | 5 | js/content.jsjs/valid.jsjs/service.js +2 more | FP 5% |
| HIGH | postinstall system command System command execution detected | 5 | js/popup.jsjs/queries.jsRewards Search Automator User Manual.pdf +2 more | Risky Plugins Authors FP 10% |
| HIGH | postinstall network communication Network communication detected | 9 | popup.htmljs/popup.jsjs/content.js +6 more | Risky Plugins Authors FP 30% |
| HIGH | postinstall persistence mechanism Persistence mechanism detected | 5 | js/valid.jspopup.htmljs/queries.js +2 more | Risky Plugins Authors FP 20% |
| HIGH | postinstall file manipulation File system manipulation detected | 7 | popup.htmljs/loading.jsjs/queries.js +4 more | Risky Plugins Authors FP 20% |
| HIGH | Cerberus Cerberus | 1 | js/queries.js | Jean-Philippe Teissier / @Jipe_ FP 5% |
| HIGH | postinstall environment access Environment variable access detected | 2 | js/queries.jsjs/service.js | Risky Plugins Authors FP 40% |
| HIGH | credential env files Environment configuration file path detected | 2 | js/valid.jsjs/queries.js | Risky Plugins Authors FP 10% |
| HIGH | WarpStrings Warp Identifying Strings | 1 | js/queries.js | Seth Hardy FP 30% |
| HIGH | credential aws credentials AWS credentials file path detected | 1 | js/valid.js | Risky Plugins Authors FP 5% |
| HIGH | SQLInjection SQL queries often need to use a hardcoded SQL string with a dynamic parameter coming from a user request. Formatting a string to add those parameters to the request is a bad practice as it can result in an SQL injection. The safe way to add parameters to a SQL query is to use SQL binding mechanisms. For more information checkout the CWE-564 (https://cwe.mitre.org/data/definitions/564.html) and OWASP A1:2017 (https://owasp.org/www-project-top-ten/2017/A1_2017-Injection.html) advisory. | 1 | js/jquery.js | FP 10% |
| HIGH | postinstall file download File download activity detected | 7 | js/content.jsjs/utils.jsjs/queries.js +4 more | Risky Plugins Authors FP 30% |
| HIGH | NoUseEval The eval function is extremely dangerous. Because if any user input is not handled correctly and passed to it, it will be possible to execute code remotely in the context of your application (RCE - Remote Code Executuion). For more information checkout the CWE-94 (https://cwe.mitre.org/data/definitions/94.html) advisory. | 1 | js/queries.js | FP 10% |
| HIGH | postinstall obfuscation Code obfuscation techniques detected | 5 | js/queries.jsRewards Search Automator User Manual.pdfjs/jquery.js +2 more | Risky Plugins Authors FP 20% |
| HIGH | postinstall registry modification Windows registry modification detected | 3 | js/queries.jsRewards Search Automator User Manual.pdfjs/valid.js | Risky Plugins Authors FP 30% |
| HIGH | credential git credentials Git credentials/configuration path detected | 1 | js/queries.js | Risky Plugins Authors FP 20% |
| HIGH | postinstall crypto operations Cryptographic operations detected | 4 | js/queries.js_metadata/verified_contents.jsonjs/jquery.js +1 more | Risky Plugins Authors FP 30% |
| HIGH | DebuggerStatementsShouldNotBeUsed The debugger statement can be placed anywhere in procedures to suspend execution. Using the debugger statement is similar to setting a breakpoint in the code. By definition such statement must absolutely be removed from the source code to prevent any unexpected behavior or added vulnerability to attacks in production. For more information checkout the CWE-489 (https://cwe.mitre.org/data/definitions/489.html) advisory. | 4 | js/queries.jsmanifest.jsonjs/valid.js +1 more | FP 10% |
Publisher Evidence
Limited evidencePublisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
12 evidence rows available.
Finding Categories
YARA Rules Matched
18 rules(64 hits)Requested Permissions
8 permissionsFull access to Chrome DevTools debugging protocol
Access and modify data on every website you visit
Read and modify your browsing history
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
This extension automates Bing searches for Microsoft Rewards points, a legitimate use case. The 64 high-severity findings flagged in the analysis are all postinstall_* YARA rules (postinstall_persistence_mechanism, postinstall_network_communication, postinstall_system_command, etc.) matching files like js/queries.js and js/utils.js. These rules are well-documented false positives that fire on basic Node.js patterns including fetch, exec, and crypto operations in any non-trivial JavaScript. The findings_summary confirms zero actual malware signatures ("malware-signature":"0", "malware":"0"), with all 64 high-severity items categorized as code-smell.
The network findings show standard fetch and axios calls in js/valid.js:3270, js/utils.js:122, and js/content.js:301, which are necessary for an extension making API requests to Microsoft Rewards services. No suspicious or unknown domains appear in these network calls. The tabs permission flagged in manifest.json is sensitive but required for an extension that needs to interact with browser tabs to automate searches.
The developer uses a generic Gmail address ([email protected]) rather than a verified company account, which is a minor concern but not uncommon for individual developers. With 70,000 users and a clear description matching its functionality, the extension appears to be a legitimate productivity tool.
The strongest counterargument would be that 64 high-severity findings should warrant concern regardless of their classification. However, the CVEQ scoring system has documented biases where code-smell rules disproportionately inflate risk scores. These postinstall rules match legitimate code patterns in any extension that makes network requests or uses basic JavaScript APIs. The absence of actual malware signatures, suspicious IoCs, or obfuscation in the findings_summary demonstrates these are noise, not threats.
Key Reasons
- All 64 high-severity findings are postinstall code-smell rules matching standard JavaScript patterns
- Zero actual malware signatures detected (findings_summary shows malware-signature:0)
- Network findings show only standard fetch/axios calls with no suspicious domains
- Extension has 70,000 users with legitimate description matching functionality
False Positive Considerations
- postinstall_* YARA rules matching basic Node.js patterns
- Code-smell findings misclassified as high-severity malware signatures
- Score inflation from finding count rather than finding nature
Reviewed 2026-05-23; recommended action: suppress false positive; model confidence 85%.
Chrome version history
Risk trend by version
2 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
About This Extension
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace
TM Launcher
[email protected]
ReColor
[email protected]
Search Automator
[email protected]
SaaS Stack Detector
[email protected]
Suggest Me a Password
[email protected]
Web Scraper - ScrapeMate
[email protected]