What our analysis found

Street Basketball is rated caution by Extension Auditor. Our code review reported 2 findings (2 high), led by other. It comes from a publisher with 28 extensions and was last updated in April 2026.

Key findings

• high· other —The bundled manifest for version 2.7.6 declares `host_permissions: []`, while the live Chrome Web Store listing for the same version requests ` ` and ` The package under review therefore does not match what is shipped to users, and the undeclared hosts are subdomains of cloudapi.stream, the C2 domain recorded in the MalExt/ 108-extension IoC feed. (Reported as `javascript` because the schema's language enum has no JSON option; the file is.)
• high· privilege escalation —A single-player canvas basketball game exposes its runtime message port to every website on the internet, yet no file in the package registers `chrome.runtime.onMessageExternal` — the channel is declared and unused. Combined with the live manifest's extra cloudapi.stream host permissions, this is a dormant remote-control surface that any page on the publisher's C2 domain can drive as soon as an update adds the listener, and it is unjustifiable for the extension's stated Games functionality.

The bundled declares `host_permissions: []`, but the live CWS listing for this same version requests ` ` and ` — so the code I reviewed is not the code users run, and the extra hosts point at cloudapi.stream, the exact C2 domain named in the 108-extension campaign IoC. In the files that were provided the game itself is unmodified CodeThisLab boilerplate (,, `__ctlArcade*` hooks, the:801 innerHTML orientation media-query, localStorage best-score at:), but the extension-specific additions are all C2-shaped::17 declares `externally_connectable: <all_urls>` with zero `onMessageExternal` listeners anywhere in the bundle (a dormant channel any website can address once a later update adds a handler),:12 permits `'unsafe-eval'` in a sandbox CSP with no sandbox pages declared,: beacon ` ` to cloudapi.stream on, and:33-35 holds a `display:none` panel whose image and click destination are served by `multiaccount.cloudapi.stream` — a hidden `<img>` still fetches, so it pings the IoC domain on every popup open, and nothing in any reviewed file ever un-hides it. Crucially the bundle is truncated: 16 of 603 signed files were extracted, and 5 of the 7 scripts loads (`jquery-3.2.1. `, `cannon. `, `createjs. `, `howler. `, `CLang. `) are listed in but absent from disk, while the ML evidence reports 14 JS files / 1.3 MB — the model scored code I could not read, and a vendor-named file like CLang. (normally just TEXT_* constants) is precisely where this campaign hides its payload, so I cannot confirm the exfiltration sink itself. chrome-stats independently flags the cloudapi.stream host access as Critical impact, the IoC notes name cloudapi[.]stream directly, and of this publisher's other extensions are flagged malicious (context, not evidence); only our own risk-engine's 0.00 contradicts, and it scored an empty permission list from the bundled manifest that the live listing does not match. I withhold `malicious` solely because the harmful sink would live in the five scripts that were not supplied.