Flagged in the threat library: Earth Search

Our analysis confirmed the behaviour described in the threat library entry. Do not install it. Read the analysis and indicators →

Also reported by malext.io

Chrome Web Store

Earth Search for Chrome

by [email protected] · 60.0K users · 1.0 rating
f1330bb8-3f07-5034-ba19-91bceecd7cd2 | v1.0.0
46/ 100
MEDIUM risk
Threat verdict
Do not install

Confirmed member of a tracked malicious supply-chain campaign.

Analysis record

Analysed
1 months ago
Version
v1.0.0
Artifact
SHA256 26D…7EC
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

8 detail rows

YARA Rule Matches

7 rules
SeverityRuleHitsFilesMetadata
LOWpostinstall persistence mechanism 1
background.js
-
LOWpostinstall file download 1
background.js
-
LOWNoUseWeakRandom 1
background.js
-
LOWpostinstall crypto operations 1
_metadata/verified_contents.json
-
LOWpostinstall file manipulation 1
background.js
-
LOWpostinstall network communication 1
background.js
-
LOWpostinstall system command 1
popup.html
-

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

40
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
2
Portfolio

12 evidence rows available.

Finding Categories

1
Network
7
IoC Indicators

YARA Rules Matched

7 rules
postinstall persistence mechanism postinstall file download NoUseWeakRandom postinstall crypto operations postinstall file manipulation postinstall network communication postinstall system command

Security Analysis Summary

Security Analysis Overview

Earth Search for Chrome is a Chrome Web Store extension published by [email protected]. Version 1.0.0 has been analyzed by the Risky Plugins security platform, receiving a risk score of 45.54/100 (MEDIUM risk) based on 15 security findings.

Risk Assessment

This extension presents moderate security risk. Several findings were detected that may warrant attention. Users should carefully review the permissions and findings before installation.

Findings Breakdown

  • Medium: 8 finding(s)
  • Low: 7 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

  • Malware Detection: YARA rule matching against 2,400+ malware signatures
  • Secret Detection: Scanning for exposed API keys, tokens, and credentials
  • Static Analysis: Code-level security analysis for common vulnerability patterns
  • Network Analysis: Detection of suspicious network communications and endpoints
  • Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

Earth Search for Chrome is published by [email protected] on the Chrome Web Store marketplace. The extension has approximately 60K users.

Recommendation

Exercise caution with this extension. Review the detailed findings and ensure the requested permissions align with the extension's stated functionality before installation.

About This Extension

This extension adjusts your browser’s default search provider to yahoo, giving you a quick and seamless way to search the web directly from Chrome. With Earth Search for Chrome, you can instantly explore Earth views, satellite imagery, maps, and more — all with rich autosuggestions that make finding what you need faster and easier. Key Features 🌍 Instantly search for Earth & satellite images, maps, terrain views, and more from your address bar. ⚡ Smart autosuggestions to help you find locations, places, and points of interest even quicker. 🌐 Powered by Yahoo for a smooth, dependable search experience. 🛰 Discover new destinations, land formations, and global imagery with ease. Permissions To deliver these features, the extension sets Yahoo as your default search engine so results appear directly from your address bar.

Frequently Asked Questions