FanSerials

On every startup and every 5-minute alarm, the extension fetches a public GitHub Gist and stores the entire parsed JSON response into chrome.storage.local with no schema validation. The Gist owner (GitHub user 'fansserials') can push any properties — including a new baseUrl and redirectHost — at any time, effectively giving them a remote C2 channel to redirect all extension API calls and UI navigation links to an arbitrary server without any extension update.

getBaseUrl: "https://gist.githubusercontent.com/fansserials/b160316e28a2ce41b4ef3a82506953ff/raw"}...var u = function t() {  fetch(i.a.getBaseUrl)    .then(function(t) {      return t.json()    })    .then(function(t) {      chrome.storage.local.set(Object.assign({}, t), function() {        s(), a()      })    })    .catch(function(e) {      setTimeout(t, 7e3)    })};

The manifest declares webRequestBlocking combined with <all_urls>, which grants the ability to intercept, inspect, and silently modify every HTTP/HTTPS request made by the browser on any website. A search across all bundled JavaScript files (background.bundle.js, index.bundle.js, all three chunk files) finds zero chrome.webRequest.* listener registrations — these extremely powerful permissions are declared but completely dormant in the shipped code, which is consistent with an extension that acquired the permissions speculatively or in preparation for future activation via the remote Gist configuration.

{  "permissions": [    "alarms",    "activeTab",    "storage",    "webRequest",    "webRequestBlocking",    "<all_urls>"  ]}

The redirectHost value sourced from the remote Gist configuration is used as the href target for the extension popup's logo/home link and as the base for all navigation URLs including profile and subscription pages. If the Gist is updated to point redirectHost at a lookalike phishing domain, all ~68,000 users clicking links in the popup would be sent to the attacker-controlled site without any indication in the extension UI.

chrome.storage.local.get(["baseUrl"], function(t) {    e({      type: "SET_HOST",      payload: t.baseUrl    })  })  ...  var e = this.props.redirectHost.slice(0, -1)    ...    href: this.props.redirectHost,