What our analysis found

Page Auto Refresh, used by 1,000 people, is rated caution by Extension Auditor. Our code review reported 2 findings (2 medium), led by tracking. Its permissions mean it can inject scripts into pages.

Key findings

• medium· tracking —On install, and on every update while the version string compares below 6 (the current line is 2.1, so this fires on each update), the extension opens a tab at a hardcoded third-party host that is neither the publisher's website (top.rodeo) nor its declared privacy-policy host (cloudapi.stream), reporting the installation keyed by. The listing declares no data collection at all, so an beacon to an unrelated. host is undisclosed and outside the extension's stated auto-refresh purpose.
• medium· other —The extension is a repackaged copy of a third-party product — the ksoft/ copyright header is still present at:1 and:1, the internal product name throughout the UI is "Easy Auto Refresh", and the bundled icons are easy-auto-refresh-*.png — yet it is listed as "Page Auto Refresh" by an unrelated publisher with the licensing, purchase (:683) and notification-asset (:118) endpoints repointed to cloudapi.stream. Counterfeiting another vendor's extension and redirecting its paid registration flow to the repackager's own server monetizes users under a false identity, and it places an auto-updating extension with all-sites host permissions on infrastructure the publisher controls but does not disclose as such.

This is a verbatim repackage of ksoft/ 's "Easy Auto Refresh" — the upstream copyright header survives at:1 and:1, the titles still read "Easy Auto Refresh" (:109, 210, 311; modal), and the manifest still ships easy-auto-refresh-*.png icons — relisted as "Page Auto Refresh" with the original vendor's monetization rewired to cloudapi.stream (:10,:118,:683) and an beacon opening id> (:37-45), a domain matching neither the publisher site (top.rodeo) nor its privacy-policy host. Reading every script, I found no exfiltration, no remote code loading and no server-controlled channel into storage: every option written by #kiZQS comes from popup form inputs, the only outbound call is a license-code POST (:40-54), is pure date formatting, and are the genuine upstream logic. Corroborating the ML score: the 0.80 verdict, malicious sibling extensions, the cloudapi.stream IoC tag from the 108-extension campaign, and flagged peers in the permhash cluster; contradicting it: chrome-stats likelihood with a trusted-publisher badge, and code that in this version does exactly what the listing describes. cloudapi.stream is formally first-party under the disclosure rule (it is the listing's own privacy-policy host), so I do not log it as exfiltration — the concern is a counterfeit clone sitting on campaign-linked infrastructure with an update channel that could turn malicious, which is why this is suspicious rather than malicious. Hygiene notes not logged as findings:: injects server-supplied text into popup innerHTML (MV3 extension-page CSP blocks inline script),:16 passes a user-typed "document." string to setTimeout (implicit eval, but only from local popup input), keepAlive() injects a connect stub into all tabs, and browsingData.removeCache is gated on the isCache option. The XOR-7 String.fromCharCode at:60 /:59 masks a license flag, not a payload, so it is not obfuscation; the 22 innerHTML hits are popup status labels and one static-string modal.