View Package Tracking search hijacker

Overview

The View Package Tracking Chrome extension (50,000+ installs) silently overrides the browser's default search engine to viewpackagetracking.com and transmits installation and uninstallation data to the same domain. This behaviour is consistent with search hijacking, a common adware tactic where the extension monetizes user searches by redirecting them to a third-party search portal.

How it works

The extension's manifest.json includes a chrome_settings_overrides block that sets the default search provider to https://viewpackagetracking.com/auto-suggest/search.php?q={searchTerms} with is_default set to true (manifest.json:26-36). This change occurs immediately upon installation without requiring explicit user consent. In background.js, the extension sends a POST request to https://viewpackagetracking.com/auto-suggest/track.php with installation data (background.js:22-28). Additionally, chrome.runtime.setUninstallURL is used to report uninstall events (background.js:52).

Payload

The search redirect causes all address-bar queries to be routed to viewpackagetracking.com, potentially allowing the operator to collect search terms, serve ads, or further profile the user. The tracking endpoint receives installation metadata, but the exact contents of the transmitted data are not fully disclosed. The remote search page itself was not inspected, so additional behaviours such as ad injection or deeper analytics cannot be ruled out.

Store status

The extension remains listed on the Chrome Web Store with over 50,000 users and is currently active. No removal or remediation action has been observed in the available report. Users should remove the extension immediately and reset their default search engine in browser settings.