USPS Tracking Extension Search Hijacking to trackingnumbers.org

Overview

The USPS Tracking extension (store ID njincahdjloohmjeonojgjeihkgbjfko) presents as a package tracking tool but silently hijacks the user's default search engine and sends data to trackingnumbers.org. This is a case of undisclosed behavior, not merely excessive data collection. Sandbox analysis confirms search provider override via chrome_settings_overrides in manifest.json and background scripts that beacon to the operator's domain.

How it works

On installation, the extension declares chrome_settings_overrides in manifest.json lines 32-41, setting the default search provider to https://trackingnumbers.org/admin/public/link?q={searchTerms}. This means all address bar searches are routed through the operator's server instead of the user's chosen search engine. Additionally, src/js/background.js lines 9-11 shows an install handler that sends no-cors fetch requests to /admin/public/install and /admin/public/pixels on the same domain. Then src/js/background.js lines 15-20 opens a new tab to /success-search. These actions occur without any user interaction beyond accepting the extension permissions.

Payload

The search override is the primary payload. The search URL likely redirects to a search engine with affiliate tracking parameters, generating revenue for the operator. The install and pixel pings may be used for conversion tracking or to detect successful installations. The success page could be an affiliate landing page or further redirection. No credential theft or data exfiltration was observed in the analyzed code, but the extension collects installation events and search queries are sent to the operator's server.

Store status

The Chrome Web Store listing was not available for analysis, so we cannot confirm whether the search override is disclosed in the description. Regardless, the behavior is intrusive and typical of search hijackers. Users who installed this extension should remove it and manually reset their default search engine.