Is UPS Tracking safe?
UPS Tracking is high risk. Dynamic analysis captured every default omnibox search routed through trackingnumbers.org before redirecting to Yahoo via an affiliate URL. It installs as default search engine 'Online'. The listing brands this a UPS tool, undisclosed.…
Strong link to a flagged operator: 2 of the 2 other listings from the same operator are rated high or critical for malicious behavior. Flagged: USPS Tracking (high), FedEx Tracking (high).
Who publishes itUSPS Tracking - 2 other listings from the same operator, 2 of them carrying a finding
USPS Tracking - 2 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 80k+ users between them. 2 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
UPS Tracking Extension Routes All Omnibox Searches Through Operator Backend
Dynamic analysis captured every default omnibox search routed through trackingnumbers.org before redirecting to Yahoo via an affiliate URL.
It installs as default search engine 'Online'.
The listing brands this a UPS tool, undisclosed.
What actually happens
You type a search term into the Chrome address bar after installing this extension.
The extension intercepts the search and routes it through trackingnumbers.org before delivering results via Yahoo's affiliate search.
Chrome substitutes your full query into the {searchTerms} placeholder in the configured search_url, sending it to the operator's server as a plain-text GET parameter.
Captured request
HTTP 302 redirect to https://uk.search.yahoo.com/yhs/search?hspart=infospace&hsimp=yhs-mm_upstracking&p=<planted+canary+term>; a planted canary term was visible in the Yahoo redirect URL confirming full query forwarded.
Data the operator server receives for every search
- Your search query<planted marker>
The full text you typed into the address bar is sent to the operator's server as a URL query parameter before you see any results.
- Operator referral identifierhspart=infospace&hsimp=yhs-mm_upstracking
The Yahoo redirect URL carries a partner code (hsimp=yhs-mm_upstracking) tying searches to an affiliate account that pays the operator.
The code that does this
Manifest search provider override
// Chrome API: chrome_settings_overrides with is_default:true replaces the// user's configured default search engine for all omnibox searches.// {searchTerms} is substituted by Chrome with the literal typed query.// The extension is branded 'UPS Tracking' but the search endpoint// trackingnumbers.org has no affiliation with UPS.//// Background SW also fires install/pixel beacons on every install+update:const logInstallation = async () => { await fetch(`https://${DOMAIN}/admin-ups/public/install`, { mode: 'no-cors' }); await fetch(`https://${DOMAIN}/admin-ups/public/pixels`, { mode: 'no-cors' });};Destinations receiving your search data
- trackingnumbers.org
Operator-controlled backend receiving every default omnibox search as a GET parameter, plus install and pixel-beacon requests. No affiliation with UPS established.
- uk.search.yahoo.com
Final search results destination, reached via a 302 redirect from trackingnumbers.org carrying affiliate parameters (hspart=infospace, hsimp=yhs-mm_upstracking).
Address-bar suggestions send typed text to trackingnumbers.org
As Chrome's default search provider, UPS Tracking sends in-progress address-bar text as searchTerm to trackingnumbers.org before you press Enter.
Not captured live (native typing unavailable), but declared in the shipped manifest.
What actually happens
You type text into Chrome's address bar.
This can be a tracking number, a search phrase, or the beginning of a URL.
The extension's default search-provider setting routes suggestion lookups to trackingnumbers.org.
Chrome uses the configured suggestion URL as address-bar text changes.
Data placed into the suggestion request
- Current address-bar text1Z999AA10123456784
This can reveal what you are searching for or the page you are starting to visit before you finish typing.
- Browsing intentportal.company.example
Repeated suggestion lookups can show the topics, services, or internal sites you are trying to reach.
Captured request
No live response was captured; this is the shipped manifest-declared suggestion endpoint Chrome uses for omnibox suggestions.
The code that does this
The manifest makes trackingnumbers.org the default suggestion endpoint
Deobfuscated manifest search-provider settings
manifest.json"chrome_settings_overrides": { "search_provider": { "name": "Online", "keyword": "UPSTracking", "search_url": "https://trackingnumbers.org/admin-ups/public/link?q={searchTerms}", "suggest_url": "https://trackingnumbers.org/admin-ups/public/autosuggest?searchTerm={searchTerms}", "favicon_url": "https://trackingnumbers.org/admin-ups/public/favicon.ico", "encoding": "UTF-8", "is_default": true }}Deobfuscated background worker install/update handling
src/js/background.jsconst DOMAIN = 'trackingnumbers.org';const CAMPAIGN_ID = chrome.runtime.id;// Retrieve stored dataconst fetchTrackingData = () => new Promise(resolve => chrome.storage.sync.get(resolve));// Send tracking logsconst logInstallation = async () => { await fetch(`https://${DOMAIN}/admin-ups/public/install`, { mode: 'no-cors' }); await fetch(`https://${DOMAIN}/admin-ups/public/pixels`, { mode: 'no-cors' });};// Open success page in a new tabconst launchSuccessPage = async () => { chrome.tabs.create({ active: true, url: `https://${DOMAIN}/success-search-ups` });};// Set uninstall feedback pageconst configureUninstallURL = async () => { chrome.runtime.setUninstallURL(`https://${DOMAIN}/admin-ups/public/feedback`);};// Handle extension installation and updateschrome.runtime.onInstalled.addListener(async ({ reason }) => { if (reason === 'install') { await chrome.storage.sync.set({ installDate: new Date().toISOString().split('T')[0], }); await logInstallation(); await launchSuccessPage(); chrome.windows.getAll((windowList) => { console.log(windowList); windowList.forEach((win) => { if (win.type === "popup") chrome.windows.remove(win.id); }); }); } else if (reason === 'update') { await logInstallation(); await launchSuccessPage(); } await configureUninstallURL();});External host receiving suggestion traffic
- trackingnumbers.org
Receives the configured search and suggestion requests for the UPS Tracking extension.
What it can do
Permissions this extension asks for, as declared in version 1.0.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on trackingnumbers.org
*://trackingnumbers.org/*
Store data in your browser
storage