Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Package Finder Now

CRITICAL RISKRemoved from Chrome Web Store

Package Finder Now

ID: pclechhojegjkgkglclmihkphgpcjeph

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

7.471.33001

Size

1.24 MB

Rating

1.9/5

Reviews

Users

30,729

Type

Extension

Updated

Nov 13, 2023

Publisher Contextual Analysis

Trusted

Author: https://www.packagefindernow.comView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

30,729

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Package Finder Now

Keep track of your shipments from anywhere! Just enter the Package Tracking ID and: -> find out where the package is -> always know when it is going to arrive -> get notified when there is a stats change (pickup, delivery, delay) PackageFinderNow is Simple to Use. Using the PackageFinderNow toolbar, which is available on every page, you can get all the information and status changes in one place right from your browser! Install the extension and Stay Up to Date!

User Growth

Showing data from Sep 26, 2023 to Nov 19, 2023

Versions

+9.76%(+2,732 users)

Compared to 2 months ago

2 versions released in this period

Rating Count

Total: 7 ratings

Average Rating

Current: 1.86 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical3

High7

Medium1

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
5.471.33001 Code review	11

Extension Version	Code Review Findings
5.471.33001	11

Files with findings

3 distinct paths — top paths by unique finding count:

background.js9
manifest.json1
uid.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Obfuscation	critical	background.js (line 19879)	Field-name obfuscation maps. Before posting telemetry the code rewrites well-known keys (extensionId, userId, pageLocation, pageReferrer, timestamp, installEvent, uid, ticket) to gibberish dotted paths so that anyone …	5.471.33001
2	Tracking	critical	uid.js (line 130)	This content script (manifest: run_at=document_start, all_frames=true, matches=https:/// and http:///) reads the persistent installation ID from chrome.storage.local and exposes it to any web page that posts a 'ge…	5.471.33001
3	Unauthorized Data Collection	critical	background.js (line 19277)	Browser-history-style telemetry payload. Every tracked event records the full current URL (document.location.href) and referrer (document.referrer) along with a stable userId, the extensionId/version, and timezone — i…	5.471.33001
4	Data Exfiltration	high	background.js (line 1515)	Hard-coded telemetry/ad backend endpoints. The extension does no parcel-tracking work locally; instead it pings a 'trackingUrl', a 'traffic' endpoint on track.packagefindernow.com, and a deliberately innocuous-looking…	5.471.33001
5	Data Exfiltration	high	background.js (line 8232)	Telemetry is sent base64-encoded via navigator.sendBeacon (or POST fallback) to the trackingUrl. sendBeacon is specifically chosen because it fires reliably on tab/page unload and is harder to observe in DevTools, and…	5.471.33001
6	Privilege Escalation	high	background.js (line 2803)	Reads a server-supplied 'newTabReplacementUrl' out of stored app state and uses chrome.tabs.update to redirect the current tab to that arbitrary URL. Because the destination comes from remote configuration (MSTAppStat…	5.471.33001
7	Remote Code Loading	high	background.js (line 781)	Generic remote-content fetcher: pulls an arbitrary URL out of the 'subscriptions' object in storage, downloads its body as text, and stores it as a 'blacklist' that drives runtime behavior. Because the URL list is ser…	5.471.33001
8	Tracking	high	background.js (line 1801)	On install/start the extension POSTs the user's uid, install event, and 'ticket' to the deliberately-named cookiesDataUrl (https://www.packagefindernow.com/jamsandwich/grandstander), with field names mapped to random …	5.471.33001
9	Unauthorized Data Collection	high	background.js (line 8795)	Internal placement registry for ad delivery: tab-ads (TA/NTA), popups, delayed popups, popunders, and click-popunders. A 'package finder' extension has no legitimate need for popunder/click-popunder machinery; this co…	5.471.33001
10	Unauthorized Data Collection	high	background.js (line 12083)	Builds an ad-request payload that exfiltrates the visited pageUrl, pageTitle, pendingUrl, tabId, openerTabId, windowState, viewport, screen size, audio/mute state, and per-user adId for every monitored tab event. The …	5.471.33001
11	Privilege Escalation	medium	manifest.json (line 22)	The manifest grants the extension full http/https host access and injects content scripts at document_start in all frames of every site, far beyond what a 'package tracking' utility needs. This is the permission surfa…	5.471.33001

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.packagefindernow.com	/ellipse	https://www.packagefindernow.com/ellipse?ostracism=
www.packagefindernow.com	/jamsandwich/grandstander	https://www.packagefindernow.com/jamsandwich/grandstander
track.packagefindernow.com	/betray	https://track.packagefindernow.com/betray
track.packagefindernow.com	/traffic	https://track.packagefindernow.com/traffic
www.packagefindernow.com	/iterate	https://www.packagefindernow.com/iterate
www.packagefindernow.com	/pcgfndrn/log_deactivate	https://www.packagefindernow.com/pcgfndrn/log_deactivate?log=
track.packagefindernow.com	/complaint	https://track.packagefindernow.com/complaint
www.packagefindernow.com	-	https://www.packagefindernow.com
git.io	/JUIaE	https://git.io/JUIaE#

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


2.5.29.15	IPv4	-
2.5.29.17	IPv4	-
2.5.29.18	IPv4	-
2.5.29.19	IPv4	-
2.5.29.30	IPv4	-
2.5.29.31	IPv4	-
2.5.29.32	IPv4	-
2.5.29.35	IPv4	-
2.5.29.37	IPv4	-
1.3.6.1	IPv4	-
5.5.7.1	IPv4	-
2.5.29.20	IPv4	-
2.5.29.21	IPv4	-
5.5.7.48	IPv4	-
1.1.9.1	IPv4	-

Showing 1 to 15 of 20 rows

Rows per page:

1.0 out of 5 · 5 most recent reviews

Text reviews

Positive

Negative

Spam pop ups filled with malware and the occasional phising site in said pop ups. Be very careful! Use the postal service webpage for tracking your packages, not an extension or download and especially not this one! I re-added it to chrome just to leave this review and warn others! Happened to visit inlaws when this somehow got on their pc and started making it go haywire. Stay clear!

Ruth Sinclair·15 Sept 2023

Will not buy anything again from the company.

ALINE OESTERLIN·6 Sept 2023

same problem i had can not locate the company who sent me

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Package Finder Now

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating