Is Quick Recipe Hub & Custom Web Search safe?

Medium risk

Quick Recipe Hub & Custom Web Search sets Yahoo as the default search engine with affiliate tracking parameters appended to every query.

The extension replaces the browser's default search provider with a Yahoo search URL that includes hardcoded affiliate identifiers (hspart=sz, hsimp=yhs-001, param1, param2, type). Its popup search box also routes queries through a separately configured affiliate-tagged Yahoo URL. The extension's description discloses Yahoo search integration but does not disclose the affiliate monetization embedded in the search URLs.

Quick Recipe Hubv1.0.0.2Firefox Add-ons
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

New-tab searches route through a tagged Yahoo URL

When you use the new-tab search box, the extension builds a Yahoo YHS search URL from its own JavaScript instead of a plain Yahoo search URL, adding hardcoded parameters param1, param2, type, hspart, and hsimp before your search terms.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You submit a search from the extension's new-tab page.

Pressing Enter in the search box or clicking the search button calls the same search handler.

The extension did this

The extension navigates the tab to Yahoo with fixed URL parameters already attached.

Your query is appended to the value stored in specificConstants.searchComp.

02EvidenceFIELD TABLE
Fields added to the Yahoo search URL
FieldValueWhy it matters
Search endpoint
https://search.yahoo.com/yhs/searchThis is where your search is sent after you use the new-tab search box.
Partner code
hspart=szThis tags the request as coming through a specific search partner path.
Implementation code
hsimp=yhs-001This adds another fixed Yahoo YHS implementation tag to the same search request.
Campaign identifiers
param1=83720&param2=89705&type=type7020893-spa-83720-89705These fixed values identify the search-routing configuration bundled with the extension.
Your search terms
p=chicken%20recipesWhatever you type into the new-tab search box is placed in the Yahoo search URL.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://search.yahoo.com/yhs/search?param1=83720&param2=89705&type=type7020893-spa-83720-89705&hspart=sz&hsimp=yhs-001&p=chicken%20recipes
Browser navigation to Yahoo search results; no request body is used for this GET navigation.
04EvidenceCODE COMPARE
The code that does this

The new-tab page replaces the plain Yahoo URL with the tagged Yahoo YHS URL

What it actually does
Hardcoded search destinationhtml/js/constants.js
var specificConstants = {
    "API": "https:\/\/quickrecipehub.com\/apps\/",
    "domain": "quickrecipehub.com",
    "searchComp": "https://search.yahoo.com/yhs/search?param1=83720&param2=89705&type=type7020893-spa-83720-89705&hspart=sz&hsimp=yhs-001&p=",
};
Search URL selectionhtml/js/homepage.js
function search(searchBox) {
    var searchTerm = searchBox.val().trim();
    if (!searchTerm) return;
    var search = Constants.DEFAULT_SEARCH_URL + searchTerm;
    if (typeof specificConstants !== 'undefined' && !!specificConstants[OtherDimensions.searchComp]) {
        search = specificConstants[OtherDimensions.searchComp] + searchTerm;
    }
    window.location.href = search;
}
Enter key and button bindingshtml/js/homepage.js
(function () {
    HtmlUtil.documentOnLoad(function () {
        const searchBox = $(SEARCH_TEXT_CLASS);
        const searchForm = $(SEARCH_FORM_CLASS);
        const searchBtn = $(SEARCH_BTN_CLASS);
        searchBox.each(function (index) {
            var searchBoxElement = $(searchBox[index]);
            searchBoxElement.on('keypress', function (event) {
                if (event.which === 13) {
                    event.preventDefault();
                    search(searchBoxElement);
                }
            });
            searchBoxElement.focus();
        });

        searchForm.each(function (index) {
            var searchFormElement = $(searchForm[index]);
            var searchBtnElement = searchFormElement.find(SEARCH_BTN_CLASS);
            var searchBoxElement = searchFormElement.find(SEARCH_TEXT_CLASS);
            searchBtnElement.on('click', function (e) {
                e.preventDefault();
                search(searchBoxElement);
            });
        });

    });
})();
05EvidenceTHIRD PARTY LIST
External destination used by the new-tab search
  • search.yahoo.com

    Receives the Yahoo YHS search request containing the user's query and the fixed hspart, hsimp, type, param1, and param2 values.

Data recipients

search.yahoo.com
Updated 17 September 2026amo-2752313