m URL."},{"icon":"remote_host","actor":"remote","label":"Request sent","detail":"The browser is navigated to the affiliate search endpoint with those values in the query string."}],"blocks":[{"kind":"cause_effect","trigger":{"actor":"user","detail":"The page contains a form with a search input and a submit button.","summary":"You submit a search from Elegant's replacement new-tab page."},"response":{"actor":"extension","detail":"The code adds the typed query, the extension runtime ID, and a stored affiliate value named atr.","summary":"The extension redirects the browser to search.becovi.com with the search terms and tracking values in the URL."},"technicalNote":"manifest.json sets chrome_url_overrides.newtab to index.html. index.js registers a submit handler for #search, calls preventDefault(), reads #search_input, fetches chrome.storage.sync key atr, and assigns window.location.href to a https://search.becovi.com/serp.php URL with q, s, and atr query parameters."},{"kind":"field_table","fields":[{"icon":"form","label":"Your search terms","meaning":"The words you type into the new-tab search box are sent as part of the redirected search URL.","severity":"context","sampleValue":"weather tomorrow"},{"icon":"extension","label":"Extension identifier","meaning":"This identifies which Chrome extension produced the redirect.","severity":"context","sampleValue":"ekmdcgonpndmaifohgbdppdbhjjijkng"},{"icon":"tag","label":"Affiliate value","meaning":"This can associate the redirected search with an install source or affiliate channel stored by the extension.","severity":"identifies","sampleValue":"org"}],"caption":"Values placed into the search redirect URL","technicalNote":"The redirect URL uses q=encodeURIComponent(keywords), s=encodeURIComponent(chrome.runtime.id), and atr=(data['atr'] || 'org'). The atr value is stored by service_worker.js after fetching mattinastazione.com/g.php?id=0021; org is the literal fallback used when the storage value is absent."},{"url":"https://search.becovi.com/serp.php?q=weather%20tomorrow&s=ekmdcgonpndmaifohgbdppdbhjjijkng&atr=org","kind":"network_capture","method":"GET","technicalNote":"Earlier dynamic analysis loaded the extension new-tab page but did not execute the form submit trigger, so no becovi.com traffic was captured. The method is the browser's GET navigation produced by assigning window.location.href to the constructed https://search.becovi.com/serp.php URL. No request body is present for this navigation.","responseSummary":"No submitted-search response body was recorded; this URL shows the request shape constructed by the shipped code, with an illustrative search term and the code's literal atr fallback."},{"kind":"code_compare","caption":"The new-tab search form","shipped":[{"code":"","caption":"Search form in the replacement new-tab page","sourceFile":"index.html"}],"language":"html","deobfuscated":[{"code":"","caption":"Search form in the replacement new-tab page","sourceFile":"index.html"}],"technicalNote":"The deobfuscated index.html copy is identical to the shipped copy for the search form. The manifest points chrome_url_overrides.newtab to index.html, so this form is shown on Chrome's new-tab page."},{"kind":"code_compare","caption":"The new-tab redirect handler","shipped":[{"code":"$2c","caption":"Submit handler that builds the redirect URL","sourceFile":"index.js"}],"language":"js","deobfuscated":[{"code"

Is Elegant safe?

Findings