Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Yahoo奇摩搜尋

CRITICAL RISKRemoved from Chrome Web Store

Yahoo奇摩搜尋

ID: kpgfjanphejikpphkemnokcgbjghaago

Could be malicious

Supported Languages

🇹🇼Chinese (Traditional)

Extension Info & Metadata

Status

Removed

Version

3.0.0

Size

0.05 MB

Rating

2.5/5

Reviews

Users

20,000

Type

Extension

Updated

Jun 5, 2023

Publisher Contextual Analysis

Trusted

Author: https://yahoo.comView Profile
Privacy: Privacy Policy
Country: US
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 770 Broadway 9th Floor New York, NY 10003-9522 US
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

20,953

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

這項擴充功能會將Yahoo奇摩設為預設搜尋引擎。

Expand your inbox. Set Yahoo as your default search and enjoy a wider view. Downloading this Extension will: - Provide a wider view of your inbox. - Make Yahoo as your default search engine. Ensure to reload your Yahoo Mail page upon installation of this extension to start experiencing a wider view ;)

User Growth

Showing data from Apr 20, 2024 to Jan 01, 2025

Versions

No change in user count

Compared to 4 months ago

1 version released in this period

Rating Count

Total: 10 ratings

Average Rating

Current: 2.50 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High0

Medium4

Low2

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
3.0.0 Code review	6

Extension Version	Code Review Findings
3.0.0	6

Files with findings

5 distinct paths — top paths by unique finding count:

background.js2
browsergap-sw.js1
notifyPresence.js1
tracking-sw.js1
utils-sw.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	medium	background.js (line 157)	Uses declarativeNetRequest to inject an 'x-extensions-installed: searchset-v2' header into all main-frame requests to *.yahoo.com, allowing Yahoo's servers to silently identify users running this extension. Also redir…	3.0.0
2	Tracking	medium	tracking-sw.js (line 84)	Builds telemetry beacons to https://geo.yahoo.com/t and https://geo.yahoo.com/p containing a persistent client tracking ID (ctid), browser type, UI language, store ID, partner code and campaign data, then fires them v…	3.0.0
3	Tracking	medium	background.js (line 119)	Schedules a recurring 'alive' beacon every 8 hours (Chrome) / 24 hours (other) to Yahoo's geo telemetry endpoint, carrying the persistent ctid identifier. The continuous heartbeat enables long-term install-base tracki…	3.0.0
4	Tracking	medium	browsergap-sw.js (line 25)	Generates a 32-character pseudo-random CTID on first run and persists it to chrome.storage.local. This identifier is then attached to every outbound geo.yahoo.com beacon, providing a stable per-install tracking identi…	3.0.0
5	Remote Code Loading	low	utils-sw.js (line 102)	Fetches a remote JSON configuration from https://search.yahoo.com/jf/ext/conf/searchset/<channel>.json on install and uses fields from the response (frCode, spaceid, partnerCode, beaconPath, subCampaigns) to drive sea…	3.0.0
6	Unauthorized Data Collection	low	notifyPresence.js (line 1)	Content script tags every yahoo.com page's <body> with the classes 'yahoo_search_set_ext_installed' and 'extension_v2', which lets Yahoo's site-side JavaScript detect the extension's presence and tailor content/tracki…	3.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


*.yahoo.com	/*	https://.yahoo.com/
chrome.google.com	/webstore/*	https://chrome.google.com/webstore/*
search.yahoo.com	/jf/ext/conf/searchset/	https://search.yahoo.com/jf/ext/conf/searchset/
downloads.yahoo.com	/goodbye	https://downloads.yahoo.com/goodbye
(.*	-	https://(.*
.*search	//.yahoo//.com/search//	https://.*search\\.yahoo\\.com/search\\?p=(.+?
*.mail.yahoo.com	/*	https://.mail.yahoo.com/
mail.yahoo.com	-	https://mail.yahoo.com
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/tiff/1.0/	http://ns.adobe.com/tiff/1.0/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.8 out of 5 · 9 most recent reviews

Text reviews

Positive

Negative

不要亂調搜尋引擎啦!

章

章·13 Jul 2021

可以不要更改收尋引擎嗎

陳

陳Amo·29 Jun 2021

我不想更換搜尋引擎。

W.J.Liu Michael·23 Dec 2019

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Yahoo奇摩搜尋

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating