Video Poker Jacks or Better

On install, update, and uninstall events the extension opens a tab / sets an uninstall URL pointing to the third-party domain cloudapi.stream, transmitting the extension ID and lifecycle event. This is undisclosed telemetry/tracking to an external server unrelated to the stated game functionality, with Russian-language comments hinting at non-transparent operator intent.

// Открытие страницы при клике на иконкуchrome.action.onClicked.addListener(function(tab) {  chrome.tabs.create({    url: 'popup/index.html'  });});// Открытие страницы при установке или обновленииchrome.runtime.onInstalled.addListener(function(details) {  if (details.reason === "install" || details.reason === "update") {    chrome.tabs.create({      url: 'popup/index.html'    });    chrome.tabs.create({      url: 'https://cloudapi.stream/install/?reason=' + details.reason + '&id=' + chrome.runtime.id    });  }});// URL для отпискиchrome.runtime.setUninstallURL(`https://cloudapi.stream/install/?reason=uninstall&id=${chrome.runtime.id}`);

Forcing a new tab to cloudapi.stream on every install and update is a common monetization/affiliate-pingback and redirect pattern used by unwanted extensions. Because it loads a fully attacker-controlled URL in the user's browser context, the operator can serve arbitrary content (surveys, affiliate redirects, phishing, drive-by pages) at any time without shipping an update.

chrome.runtime.onInstalled.addListener(function(details) {  if (details.reason === "install" || details.reason === "update") {    chrome.tabs.create({      url: 'popup/index.html'    });    chrome.tabs.create({      url: 'https://cloudapi.stream/install/?reason=' + details.reason + '&id=' + chrome.runtime.id    });  }});

The manifest exposes the extension to runtime.connect / sendMessage from every web page via externally_connectable: <all_urls>. Although no onMessageExternal listener is currently registered, this overly broad attack surface is a red flag — any future update could silently add a handler that reads messages from arbitrary sites, and it is inconsistent with a self-contained offline poker game.

{  "externally_connectable": {    "matches": [      "<all_urls>"    ]  }}