Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Hockey Start

CRITICAL RISKRemoved from Chrome Web Store

Hockey Start

ID: jjgpogfheinfagnlhghfbbpmppkkakap

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.1.0.0

Size

0.13 MB

Rating

4.2/5

Reviews

Users

50,000

Type

Extension

Updated

Nov 13, 2023

Publisher Contextual Analysis

Trusted

Author: nStart onlineView Profile
Privacy: Privacy Policy
Country: US
MX records exist: No
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: No
Address: 2801 Greene St. Suite #5 Hollywood, FL 33020-1128 US

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

160,057

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Hockey Start - Follow The Game - See The Latest Hockey Results and Updates

Hockey Start - Get quick access to top Sports sites for live scores, latest news and updates. We provide top sports experience in your new tab. Get fast and easy access to major websites that are providing Hockey updates The search features use within the extension will be provided by top search engines; however, the extension will not make any changes in your default browser search setting. By installing the Hockey Start Chrome extension you agree to install this application, and you agree to the End User License Agreement and the Privacy Policy. End User License Agreement - https://www.nstart.online/trms Privacy Policy - https://www.nstart.online/pp How to remove this extension from your Chrome? You can open your Chrome browser’s Settings and find our extension in the Extensions page. Click on the “Remove” button and it will be completely removed. Alternatively, you can right-click on the extension’s icon on your browser, select “Remove from Chrome” from the drop-down menu.

User Growth

Showing data from Apr 20, 2024 to Feb 06, 2025

Versions

-16.67%(-10,000 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 34 ratings

Average Rating

Current: 4.24 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High5

Medium2

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.0.0 Code review	7

Extension Version	Code Review Findings
1.1.0.0	7

Files with findings

3 distinct paths — top paths by unique finding count:

background.js3
js/search.js3
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Data Exfiltration	high	js/search.js (line 272)	User-entered search queries are sent to search.nstart.online together with affiliate identifiers (spid, sspid, source, source_version) and an MD5-hashed persistent machine id. This redirects searches away from the use…	1.1.0.0
2	Phishing	high	js/search.js (line 29)	The extension overrides chrome's newtab (see manifest chrome_url_overrides.newtab) and captures all search queries typed into the custom search box, forwarding them through a controlled search provider rather than the…	1.1.0.0
3	Privilege Escalation	high	manifest.json (line 21)	The manifest overrides the browser's new tab page and grants host permissions + cookies access to two unrelated third-party monetization domains (efeho.pw and nstart.online subdomains). Combined with the background.js…	1.1.0.0
4	Tracking	high	background.js (line 139)	The extension beacons install/state telemetry (device id 'dhid', machine id 'mid', and extension version) to a tracking endpoint on the suspicious TLD efeho.pw (a 'pixlin' pixel). This is an unauthorized install/track…	1.1.0.0
5	Unauthorized Data Collection	high	background.js (line 17)	On install, the extension reads all cookies from the affiliate tracking domain t.nstart.online and harvests a wide list of marketing/affiliate identifiers (partner_id, click_id, mid, traffic_source, campaign, mkt_mate…	1.1.0.0
6	Obfuscation	medium	js/search.js (line 41)	A full inline MD5 implementation is bundled purely to hash the persistent machine id ('mid') before it is appended to every outgoing search URL. Hashing the identifier client-side obscures the raw id in network traffi…	1.1.0.0
7	Tracking	medium	background.js (line 172)	If no 'mid' cookie is present, the extension fabricates a persistent per-user GUID and stores it in chrome.storage.sync so it travels with the Google account across devices. This creates a stable fingerprint/identifie…	1.1.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.efeho.pw	/pt/pixlin	https://www.efeho.pw/pt/pixlin?pid=f8b33670&cid=
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/
ns.adobe.com	/exif/1.0/	http://ns.adobe.com/exif/1.0/
search.nstart.online	/pse/search	https://search.nstart.online/pse/search?&query=${encodeURIComponent(search_query
www.apache.org	/licenses/LICENSE-2.0	http://www.apache.org/licenses/LICENSE-2.0
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
nhl.com	-	https://nhl.com/
hockeydb.com	-	https://hockeydb.com/
hockey-reference.com	-	https://hockey-reference.com/

Showing 1 to 10 of 30 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.1.0.0	IPv4	-

4.8 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Hello, I hope you're having a splendid day! I am currently seeking opportunities to expand my business operations by investing in extensions with a significant user base, beginning from 50,000 users and up. No matter if your extension has a modest user base or counts its users in the millions, I am interested and ready to negotiate a purchase. If you are in possession of such an extension and looking to turn it into a profit, please consider reaching out to me. We can discuss the price and proceed with a transparent and secure transaction through a trusted escrow service based in the United States. It's great that Google allows the transfer of extension ownership between accounts, so your Google account ownership will remain intact. If you have any needs, please contact us via the following contacts Whatsapp: +1 (248) 896‑8035 Telegram: t.me/harryysandersonn

Abner Wirtz·5 Jun 2024

j'ai adoré

Paul Niadjou·23 Aug 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Hockey Start

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version7

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews