Search Pro

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The background.js file contains a single fetch request ("NET-FETCH-background.js-4") that points to URLs on the extension’s own domain (https://src.searchpro-ext.com/?tid=1078852&q= and https://pxl.searchpro-ext.com/thx'). These URLs are also reported as IoCs ("XIOC-URL-https://src.searchpro-ext.com/...", "XIOC-URL-https://pxl.searchpro-ext.com/thx',", "XIOC-DOMAIN-pxl.searchpro-ext.com", "XIOC-DOMAIN-searchpro-ext.com"). Because the domains belong to the extension publisher and are used for legitimate telemetry or asset loading, they do not constitute suspicious third‑party communication. The extractor also flags a benign third‑party domain (www.inkscape.org) and Google infrastructure (clients2.google.com, clients2.google.com/service/update2/crx), which are common in many extensions and are listed as known false‑positive sources.

The only other notable finding is an obfuscation alert in background.js ("OBFUSCATION-SUSPICIOUS_EXTERNAL_IMPORT-background.js-0"). This rule is triggered by a generic pattern that frequently matches standard module imports or minified code and is recognized as a frequent false positive in CVEQ analyses. No additional signs of code packing, encrypted strings, or dynamic script generation are present.

There are no malware‑signature matches, no credential‑related API usage, and no evidence of browser‑hijacking behaviors such as new‑tab replacement or search‑engine manipulation. The extension’s manifest (not provided) does not indicate permissions that would enable cookie stealing or proxying, and the single network call is limited to its own server. The extension’s description and developer contact ([email protected]) do not mimic a popular product, so typosquatting is absent.

A skeptic might argue that the presence of an obfuscation finding and external fetch calls suggests hidden malicious intent, especially given the lack of a user base (user_count = 0) which could hide a newly published threat. However, the obfuscation rule is a known low‑confidence indicator, and the network calls are directed solely to the publisher’s domain, not to known tracking or command‑and‑control infrastructure. Without any malware signatures, credential access, or hijacking code, the balance of evidence points to benign functionality rather than a genuine threat.

In conclusion, the extension’s behavior is limited to self‑hosted network requests, and the flagged obfuscation is most likely a false positive. Users can consider it safe, though routine monitoring for future updates is advisable.

Key Reasons

• Only self‑hosted network calls observed in background.js
• No malware signatures or credential‑stealing code
• Obfuscation flag matches a known false‑positive pattern
• IoCs include benign domains and the extension’s own domain
• No impersonation or hijacking techniques detected

False Positive Considerations

• IoC extractor flags own and common domains as suspicious
• Obfuscation rule 'suspicious_external_import' often misfires on normal imports
• Low code‑smell count not relevant

Reviewed 2026-05-23; recommended action: suppress false positive; model confidence 86%.