Is View Package Tracking safe?

High risk

View Package Tracking sets viewpackagetracking.com as your default search engine and sends every omnibox query and keystroke there.

The extension's manifest declares viewpackagetracking.com as the browser's default search provider (is_default:true), so all searches typed in the address bar are routed to its search.php endpoint rather than your chosen engine. It also registers a suggest_url, which makes Chrome transmit each partial query to the /auto-suggest/ endpoint as you type for autocomplete. On install, update, and startup the background worker also sends an install/uninstall tracking ping with a random ID, the extension version, and your user-agent to the same domain.

Online Search Toolv1.0.0Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Default search engine replaced; all queries routed via affiliate redirect

Installing View Package Tracking replaces your default search engine with viewpackagetracking.com.

Dynamic analysis observed every omnibox query sent there, forwarded to Yahoo via an Infospace affiliate link; partial queries go there too.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension and type a search query in the browser address bar.

This applies to any search, not just package tracking, because the extension sets itself as the default search engine.

The extension did this

The extension routes your query to viewpackagetracking.com, which forwards it to Yahoo Search via an Infospace affiliate link.

Partial keystrokes are also forwarded in real time via the suggest_url endpoint before you finish typing.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://viewpackagetracking.com/auto-suggest/search.php?q=track+my+amazon+order
HTTP 302 redirect to uk.search.yahoo.com/yhs/search?hspart=infospace&hsimp=yhs-075&p=track+my+amazon+order, affiliate-attributed Yahoo search result page.
03EvidenceCODE COMPARE
The code that does this

Manifest search provider override (manifest.json)

What it actually does
// is_default: true — Chrome replaces the user's existing default search engine
// (Google, Bing, etc.) with this provider on install. Every omnibox search,
// not just 'track' keyword queries, is submitted to search.php.
//
// suggest_url — Chrome calls this endpoint after each keystroke in the omnibox,
// transmitting the partial query before the user presses Enter.
04EvidenceFIELD TABLE
Data sent on install (track.php beacon)
FieldValueWhy it matters
Session ID
viewpack_1717545123456_k3m9xq2r1A randomly generated string used to track your install session.
User-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Your browser version, operating system, and device type.
Extension version
1.0.0The installed extension version number.
05EvidenceTHIRD PARTY LIST
Domains that receive your search queries
  • viewpackagetracking.com

    First hop for all omnibox searches and keystroke suggestions. Operates the search_url and suggest_url endpoints; also receives the install beacon.

  • uk.search.yahoo.com

    Final search destination. Receives the full query via Infospace affiliate redirect (hspart=infospace, hsimp=yhs-075). The extension earns a referral fee per search.

Data recipients

viewpackagetracking.com
Updated 17 September 2026ejpgchjcnlcgngfcomaoappdaemngghl