Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Recipe Search

CRITICAL RISKRemoved from Chrome Web Store

Recipe Search

ID: dgdkdomcllabejalhmecfjilaokmecjm

Could be malicious

Supported Languages

🇺🇸US English

Extension Info & Metadata

Status

Removed

Version

1.23.103

Size

0.07 MB

Rating

1.0/5

Reviews

Users

13,448

Type

Extension

Updated

Jan 6, 2023

Publisher Contextual Analysis

Author: recipessearchnowView Profile
Privacy: Privacy Policy
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 248 3rd Street #312 Oakland, CA 94607 US
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

33,448

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Set as a default Search provider to provide enhanced search suggestion for recipes keywords in Omnibox and show Web/Recipes Results.

Set as a default Search provider to provide enhanced search suggestion for Recipes keywords in Omnibox and show Web/RecipesResults. Simple and Easy to use: 1. Begin by typing keyword in Address Bar 2. Get suggestion for matched recipes. (you can identify recipe suggestions easily as they are diplayed with extension icon next to them) 3. Select the suggestion for Recipe 4. Get Results This extension updates your default Search to Yahoo.com for web results. By installing this extension, you agree to the Terms of Service (https://printrecipes.net/terms-of-service/) and Privacy Policy (https://printrecipes.net/privacy-policy/)

User Growth

Showing data from Aug 19, 2022 to Jul 12, 2023

Versions

+94.64%(+6,539 users)

Compared to 3 months ago

3 versions released in this period

Rating Count

Total: 1 ratings

Average Rating

Current: 1.00 / 5.0+1.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High6

Medium3

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.22.811 Code review	9

Extension Version	Code Review Findings
1.22.811	9

Files with findings

3 distinct paths — top paths by unique finding count:

lib/ext.js6
manifest.json2
content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	high	lib/ext.js (line 203)	Installs dynamic declarativeNetRequest redirect rules that intercept the user's search navigations and rewrite them through a monetization endpoint (search.php) with a persistent per-user guid and a partner/affiliate …	1.22.811
2	Phishing	high	content.js (line 11)	Content script (matched on `://search.yahoo.com/yhs/search?hspart=tro` per the manifest) injects a full-page green-checkmark lightbox urging the user to click 'Keep it' to 'Continue to use Freshy Search'. The overla…	1.22.811
3	Tracking	high	lib/ext.js (line 149)	On install, beacons api.freshysearch-api.net with the user's region, partner_name, extension id/version and receives back a configuration blob whose every key is written into chrome.storage. Combined with the cookie-b…	1.22.811
4	Tracking	high	lib/ext.js (line 62)	Auto-fires a `consentAccept` beacon to the operator's API on first startup, fabricating a record that the user agreed to data collection without any in-extension consent UI. The tbid/installDate parameters tie this fa…	1.22.811
5	Unauthorized Data Collection	high	manifest.json (line 27)	Forces the browser's default search provider to a third-party endpoint (freshysearch-api.net) that the extension owner controls. Every keystroke in the address bar is sent to enhanced-meta.freshysearch-api.net via the…	1.22.811
6	Unauthorized Data Collection	high	lib/ext.js (line 106)	Reads an 'ext_config' cookie set on freshysearch-api.net and blindly imports every JSON key/value into chrome.storage. This is a covert web-to-extension control channel: any web page on the operator's domain can injec…	1.22.811
7	Privilege Escalation	medium	lib/ext.js (line 38)	Immediately after install, locates the user's open Chrome Web Store tab for this extension and force-closes it, then redirects the affiliate landing page to an 'ext-installed' hash. Closing the CWS tab hides the only …	1.22.811
8	Tracking	medium	lib/ext.js (line 257)	Sets an uninstall URL that beacons the user's persistent guid on removal. The uninstallID configured in worker.js is `223149Ly9hcmNhZGV0YWIuY29t`; the trailing base64 segment decodes to `//arcadetab.com`, indicating t…	1.22.811
9	Tracking	medium	manifest.json (line 42)	Injects content.js into Yahoo search result pages bearing the `hspart=tro` affiliate tag — the standard 'tro' partner tag used by search-monetization affiliate networks. The script's only purpose on yahoo.com is to re…	1.22.811

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
api.${this.config.apidomain}	/api/v2/action%60	https://api.${this.config.apiDomain}/api/v2/action`
${this.config.sitedomain}	/$%7Bthis.config.yID%7D/$%7Bthis.config.firstRunPath%7D%60	https://${this.config.siteDomain}/${this.config.yID}/${this.config.firstRunPath}`
api.${this.config.apidomain}	/api/v2/json/install	https://api.${this.config.apiDomain}/api/v2/json/install?`
search.${this.config.apidomain}	/crx/search.php	https://search.${this.config.apiDomain}/crx/search.php?k=\\1&type=${type}&guid=${guid}`,
search.${this.config.apidomain}	/search/(.*	https://search.${this.config.apiDomain}/search/(.*
${this.config.homepage}	/recipes	https://${this.config.homepage}/recipes?q=\\2&type=${type}&guid=${guid}`,
search.${this.config.apidomain}	/search/(.+	https://search.${this.config.apiDomain}/search/(.+
uninstall.${this.config.apidomain}	-	https://uninstall.${this.config.apiDomain}/?id=${
cooking.freshy.com	/core/v2/complete	https://cooking.freshy.com/core/v2/complete

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Recipe Search

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Growth

Rating Count

Average Rating