Is UPS Tracking safe?

High risk

UPS Tracking is high risk. Dynamic analysis captured every default omnibox search routed through trackingnumbers.org before redirecting to Yahoo via an affiliate URL. It installs as default search engine 'Online'. The listing brands this a UPS tool, undisclosed.…

Strong link to a flagged operator: 2 of the 2 other listings from the same operator are rated high or critical for malicious behavior. Flagged: USPS Tracking (high), FedEx Tracking (high).

USPS Trackingv1.0.0.0Chrome Web Store
75Risk
Who publishes it

USPS Tracking - 2 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
USPS Tracking

Same store account

2 other listings published from this account, 80k+ users between them. 2 of them carry a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

UPS Tracking Extension Routes All Omnibox Searches Through Operator Backend

HighunwantedCWE-359Dynamic sandbox

Dynamic analysis captured every default omnibox search routed through trackingnumbers.org before redirecting to Yahoo via an affiliate URL.

What actually happens

You did this

You type a search term into the Chrome address bar after installing this extension.

The extension did this

The extension intercepts the search and routes it through trackingnumbers.org before delivering results via Yahoo's affiliate search.

Chrome substitutes your full query into the {searchTerms} placeholder in the configured search_url, sending it to the operator's server as a plain-text GET parameter.

Captured request

GEThttps://trackingnumbers.org/admin-ups/public/link?q=<planted+canary+term>

HTTP 302 redirect to https://uk.search.yahoo.com/yhs/search?hspart=infospace&hsimp=yhs-mm_upstracking&p=<planted+canary+term>; a planted canary term was visible in the Yahoo redirect URL confirming full query forwarded.

Data the operator server receives for every search

  • Your search query
    <planted marker>

    The full text you typed into the address bar is sent to the operator's server as a URL query parameter before you see any results.

  • Operator referral identifier
    hspart=infospace&hsimp=yhs-mm_upstracking

    The Yahoo redirect URL carries a partner code (hsimp=yhs-mm_upstracking) tying searches to an affiliate account that pays the operator.

The code that does this

Manifest search provider override

Readable version
// Chrome API: chrome_settings_overrides with is_default:true replaces the// user's configured default search engine for all omnibox searches.// {searchTerms} is substituted by Chrome with the literal typed query.// The extension is branded 'UPS Tracking' but the search endpoint// trackingnumbers.org has no affiliation with UPS.//// Background SW also fires install/pixel beacons on every install+update:const logInstallation = async () => {    await fetch(`https://${DOMAIN}/admin-ups/public/install`, { mode: 'no-cors' });    await fetch(`https://${DOMAIN}/admin-ups/public/pixels`, { mode: 'no-cors' });};

Destinations receiving your search data

    • trackingnumbers.org

    Operator-controlled backend receiving every default omnibox search as a GET parameter, plus install and pixel-beacon requests. No affiliation with UPS established.

    • uk.search.yahoo.com

    Final search results destination, reached via a 302 redirect from trackingnumbers.org carrying affiliate parameters (hspart=infospace, hsimp=yhs-mm_upstracking).

Address-bar suggestions send typed text to trackingnumbers.org

MediumunwantedCWE-359Dynamic sandbox

As Chrome's default search provider, UPS Tracking sends in-progress address-bar text as searchTerm to trackingnumbers.org before you press Enter.

What actually happens

You did this

You type text into Chrome's address bar.

This can be a tracking number, a search phrase, or the beginning of a URL.

The extension did this

The extension's default search-provider setting routes suggestion lookups to trackingnumbers.org.

Chrome uses the configured suggestion URL as address-bar text changes.

Data placed into the suggestion request

  • Current address-bar text
    1Z999AA10123456784

    This can reveal what you are searching for or the page you are starting to visit before you finish typing.

  • Browsing intent
    portal.company.example

    Repeated suggestion lookups can show the topics, services, or internal sites you are trying to reach.

Captured request

GEThttps://trackingnumbers.org/admin-ups/public/autosuggest?searchTerm={searchTerms}

No live response was captured; this is the shipped manifest-declared suggestion endpoint Chrome uses for omnibox suggestions.

The code that does this

The manifest makes trackingnumbers.org the default suggestion endpoint

Readable version

Deobfuscated manifest search-provider settings

manifest.json
"chrome_settings_overrides": {   "search_provider": {      "name": "Online",      "keyword": "UPSTracking",      "search_url": "https://trackingnumbers.org/admin-ups/public/link?q={searchTerms}",      "suggest_url": "https://trackingnumbers.org/admin-ups/public/autosuggest?searchTerm={searchTerms}",      "favicon_url": "https://trackingnumbers.org/admin-ups/public/favicon.ico",      "encoding": "UTF-8",      "is_default": true   }}

Deobfuscated background worker install/update handling

src/js/background.js
const DOMAIN = 'trackingnumbers.org';const CAMPAIGN_ID = chrome.runtime.id;// Retrieve stored dataconst fetchTrackingData = () =>     new Promise(resolve => chrome.storage.sync.get(resolve));// Send tracking logsconst logInstallation = async () => {    await fetch(`https://${DOMAIN}/admin-ups/public/install`, { mode: 'no-cors' });    await fetch(`https://${DOMAIN}/admin-ups/public/pixels`, { mode: 'no-cors' });};// Open success page in a new tabconst launchSuccessPage = async () => {    chrome.tabs.create({        active: true,        url: `https://${DOMAIN}/success-search-ups`    });};// Set uninstall feedback pageconst configureUninstallURL = async () => {    chrome.runtime.setUninstallURL(`https://${DOMAIN}/admin-ups/public/feedback`);};// Handle extension installation and updateschrome.runtime.onInstalled.addListener(async ({ reason }) => {    if (reason === 'install') {        await chrome.storage.sync.set({            installDate: new Date().toISOString().split('T')[0],        });        await logInstallation();        await launchSuccessPage();        chrome.windows.getAll((windowList) => {            console.log(windowList);            windowList.forEach((win) => {                if (win.type === "popup") chrome.windows.remove(win.id);            });        });    } else if (reason === 'update') {        await logInstallation();        await launchSuccessPage();    }    await configureUninstallURL();});

External host receiving suggestion traffic

    • trackingnumbers.org

    Receives the configured search and suggestion requests for the UPS Tracking extension.

What it can do

Permissions this extension asks for, as declared in version 1.0.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on trackingnumbers.org

    *://trackingnumbers.org/*

  • Store data in your browser

    storage

Updated 15 October 2026cgdelbjbpigakkmnampgkeigekpacodn