Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
2 medium-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Goalkeeper Challenge is rated caution by Extension Auditor. Our code review reported 2 findings (2 medium), led by other. It comes from a publisher with 32 extensions and was last updated in April 2026.
Key findings
- Medium
Other
The bundled 2.6.8 manifest declares host_permissions [], while the live CWS listing summary declares [domain withheld], wheel.cloudapi.stream, mines.cloudapi.stream and top.rodeo. I resolved the discrepancy against the archived version sidecars: the listing summary is byte-for-byte 2.6.7's manifest, so the store metadata lags the stripped 2.6.8 package rather than a hidden live build — but it means the listing still advertises access to the domains our own IoC entry names as C2. Independently, externally_connectable <all_urls> lets any page on the web open a port to this extension's service worker while registers no handler, so the surface is declared with no legitimate consumer and is restored to usefulness by any single update.
- Medium
Other
Every install and every subsequent update force-opens a tab on cloudapi.stream, the operator domain our IoC entry identifies as the campaign C2, and uninstall pings the same endpoint. The payload itself is only the install reason and the extension ID, and the domain matches the publisher's own privacy-policy host, so this is not exfiltration — the risk is that the service worker hands an attacker-controlled page a foreground tab on the user's browser on an operator-chosen schedule, which is how the removed 2.6.7 paywall funnel (mines.cloudapi.stream / topup.cloudapi.stream) reached users. A game that ships zero permissions has no functional need for an update-triggered navigation to its vendor.
Analyst notes
The supplied bundle held only 13 of the 167 signed files (per), so I pulled the full 2.6.8 ZIP from the local CRX archive and reviewed and the other missing libraries there. Version 2.6.8 itself contains no malicious code: permissions [] and host_permissions [] (:29), no content scripts, no anywhere outside vendor libraries, and plus CLang. and are byte-identical (sha256 2562d2312e54 / 72b45a5a4797 / 9bfe8e307ba0) across all ten archived versions back to 1.2.0 — the unmodified CodeThisLab goalkeeper template, whose localStorage use is only game save state keyed '<url>.gui'. What keeps this off 'likely_benign' is version history I verified in the archive, not reputation: the immediately preceding 2.6.7 shipped, which POSTed localStorage 'user_id' to [domain withheld], rendered server-supplied HTML into the page via innerHTML, and rewrote.buyBtn hrefs to [domain withheld], backed by host_permissions for [domain withheld], wheel.cloudapi.stream, mines.cloudapi.stream and top.rodeo; 2.6.8 deleted that file plus and emptied host_permissions, published around 2026-04-17, days after the 2026-04-14 Socket IoC entry naming cloudapi.stream as C2. 2.6.8 still beacons to that same operator domain (:15,20) and still declares externally_connectable <all_urls> with no onMessage listener to receive it, so the socket is inert today but one update restores reach — which corroborates the publisher signal ( malicious) and chrome-stats' domain flag, while the ML score 0.97 is contradicted at code level: the js_xmlhttprequest (2), js_innerhtml (34) and js_appendchild (51) hits all land in jQuery 3.2.1, CreateJS, r75, howler and Bootstrap, and the 2.2 MB js_size is those vendor bundles.
Goalkeeper Challenge Chrome extension security report
ID: ijfmkphjcogaealhjgijjfjlkpdhhojk
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- GameGen
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
Screenshots & videos
Install growth
This extension requests no permissions and has no recorded risk factors.
- 2 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
2 medium-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Goalkeeper Challenge: Chrome extension game
Read the publisher’s full description
Goalkeeper Challenge is a HTML5 Soccer Game. 10 different levels of increasing difficulty to test your reflexes saving as many shots at goal as possible. It’s all in your hands!
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
2 medium-severity findings in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from GameGen
- Downloader For Instagram2,000 users
- American Roulette Royale1,000 users
- Car Rush384 users
- Web Client for game BASEBALL PRO335 users
- Slot Machine Mr Chicken214 users
Popular in Games
- Boxel Rebound1,000,000 users
- Eneba - Seamless Keys Activation and Cheap Games Offers700,000 users
- Stacker - Falling tetra blocks!700,000 users
- Ultimate Car Driving Game500,000 users
- Boxel 3D500,000 users
Store rankings
Where this extension appears in store category, collection and keyword rankings.