A featured Chrome extension "Planet Search" (2M installs) routes every query to the nextgeeker[.]com hijacker network

<!-- SC_OFF --><div class="md"><p>While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (<code>kadaohckdkghfaclhjmkmplebcdcnfnp</code>), Featured, 2M users, publisher <strong>FREE VPN PLANET SRL</strong>.<br /> <strong>The extensions has a 0-byte background.js with zero permissions.</strong><br /> The whole mechanism is one <code>chrome_settings_overrides</code> search provider, so nothing shows up statically. It's all server-side.</p> <p>Declared provider is <code>planet-search[.]com</code>. Tracing:</p> <pre><code>planet-search[.]com/search/?q= 301 → s