What our analysis found

Web Client for game Cricket Batter Challenge is rated caution by Extension Auditor. Our code review reported 1 finding (1 high), led by other. It comes from a publisher with 28 extensions and was last updated in April 2026.

Key findings

• high· other —The bundled manifest of the version under review declares only storage and sidePanel, while the live Chrome Web Store listing for this extension ID requests an additional notifications permission, so the published build is not the build in this package. Corroborating the drift,:6239 calls chrome.downloads.download even though no downloads permission is declared here, meaning that handler can only have worked under a different permission set. A shipped build whose permissions exceed the audited package means the audited code cannot be used to vouch for what users are actually running.

The code I could read is a thin Vue wrapper that iframes a remotely hosted cricket game (:7834,) plus an ping carrying only (:6188-6192) to the publisher's own cloudapi.stream, so nothing visible exfiltrates user data; but I cannot clear the extension because — the script the side panel actually runs (side_panel.default_path + setPanelBehavior openPanelOnActionClick,:6180) and roughly 445 KB of the 1,217,404-byte JS total, present in 's signed file list — was not included in the extraction bundle, and the only ML-flagged patterns absent from the files I have (XMLHttpRequest, fromCharCode) must live in it. Independent code-level anomalies keep this above benign: the bundled manifest declares only storage+sidePanel while the live CWS listing also requests notifications (version drift, a mismatch per instruction 4); host permissions for wheel.cloudapi.stream, mines.cloudapi.stream, top.rodeo and have zero references anywhere in the visible code; a random per-install user ID is minted and stored with nothing visible reading it; and the package is a repurposed Telegram "Sidegram" sidebar kit ( is a Telegram Sidebar privacy policy,, a download handler calling chrome.downloads without the downloads permission, referenced but absent). The IoC feed naming cloudapi.stream as shared C2 and the publisher's malicious siblings corroborate the ML score; chrome-stats and our own Low risk-engine rating contradict it. I stop at suspicious rather than likely_malicious because escalating further would rest on reputation context, not on code I read.