flappy birdie (night farm mode)

game.js is registered as a content script injected into every frame of every page the user visits, despite the extension being a self-contained popup game. There is no legitimate game logic reason for this — the game's DOM targets (player, land, flyarea) only exist inside the popup. This pattern is consistent with a surveillance foothold: the same file that runs the popup game is silently injected into every website the user browses, granting execution context on all pages. A future update to game.js could add data-harvesting code without changing the manifest.

{  "content_scripts": [    {      "js": [        "js/game.js"      ],      "all_frames": true,      "matches": [        "*://*/*"      ]    }  ]}

The same script (game.js) is registered as both the background service worker and a content script. Service workers and content scripts serve fundamentally different roles; sharing a single file across both contexts is architecturally anomalous. Running the game engine as a persistent background worker combined with all-page content script injection gives the extension two independent execution contexts watching all browsing activity, which is a common structure for adware and tracking extensions disguised as games.

{  "background": {    "service_worker": "js/game.js"  },  "content_scripts": [    {      "js": [        "js/game.js"      ],      "all_frames": true,      "matches": [        "*://*/*"      ]    }  ]}

Every file in the extension (including all JavaScript, images, and assets) is declared accessible to any URL on the web. This wildcard resource exposure allows any third-party website to probe the presence and exact file listing of this extension, enabling reliable browser fingerprinting and extension-targeting attacks. Legitimate game extensions need at most a small subset of resources exposed, never a blanket wildcard.

{  "web_accessible_resources": [    {      "matches": [        "<all_urls>"      ],      "resources": [        "*.*"      ]    }  ]}

The share URLs are pre-populated with `via=w3technic` on Twitter and the extension developer's homepage URL across all social platforms (Facebook, Pinterest, WhatsApp, VK, Telegram). Every time a user shares their score, viral attribution is funneled to the developer's social accounts. This is a covert growth-hacking mechanism embedded in a game — the user's social graph is being monetized without disclosure.

let Twitter = "https://twitter.com/intent/tweet/?text=" + encodeURI(shareText) + "&url=" + encodeURI(homePage) +  "&via=w3technic";let sendMail = "mailto:?subject=" + encodeURI(shareText) + "&body=" + encodeURI(homePage);let Pinterest = "https://pinterest.com/pin/create/button/?url=" + encodeURI(homePage) + "&media=" + encodeURI(  homePage) + "&description=" + encodeURI(shareText);let Whatsapp = "whatsapp://send?text=" + encodeURI(shareText) + encodeURI(homePage);let VK = "http://vk.com/share.php?title=" + encodeURI(shareText) + "&url=" + encodeURI(homePage);let Telegram = "https://telegram.me/share/url?text=" + encodeURI(shareText) + "&url=" + encodeURI(homePage);

The internal version reported to Chrome's update system (1.5.3) does not match the display version shown to users (1.0.2). This discrepancy means the extension has silently advanced further than users believe, obscuring its update history and making it harder to correlate published changelogs with the code actually running.

{  "version": "1.5.3",  "version_name": "1.0.2"}