Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Tracking Package [browser-hijack] + malext.io malicious_extension_sentry (+2.5, capped).
• Default search engine silently redirected to onlinemypackage.com — classic search-hijack monetization.
• Privacy policy admits data collection and third-party sharing without scoping to this extension (D rule: +10.0).
• Uninstall and install URL hijacks both present — aggressive lifecycle monetization hooks.
• Extension name/domain mismatch: developer is QwerPDF but extension routes searches via onlinemypackage.com and xtracking.me.

Evidence

• search_provider_override manifest chrome_settings_overrides sets default search to onlinemypackage.com/search-package.php; is_default=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; aggressive lifecycle hook flagged by scanner.
• install_url_hijack crx install_url_hijack=true; extension opens 3rd-party page on install.
• privacy_policy_inadequate api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — D rule applies.
• external_js_host_mismatch crx js_external_hosts includes xtracking.me — unrelated to stated package-tracking function.
• developer_domain_mismatch store Developer email @qwerpdf.com; extension routes to onlinemypackage.com and xtracking.me.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; only 20 installs.
• content_scripts_yahoo_search manifest Content scripts injected into search.yahoo.com/search* enabling query capture.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Tracking Package [browser-hijack] + malext.io malicious_extension_sentry; score 5.77 -> 8.27 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Used to persist settings locally; low direct harm potential.
• *://search.yahoo.com/* (host_permission) medium Allows content script injection into Yahoo Search pages; scoped but enables query interception.
• chrome_settings_overrides.search_provider (is_default) high Overrides default search engine to onlinemypackage.com; core search-hijack vector.

Pillar Scores

Bookkeeping