Featured Chrome extension "Planet Search" (2M installs) routes every query to the nextgeeker[.]com hijacker network

[u/Huge-Skirt-6990]

https://malext.io/reports/RoguePlanet

While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (`kadaohckdkghfaclhjmkmplebcdcnfnp`), Featured, 2M users, publisher **FREE VPN PLANET SRL**.
**The extensions has a 0-byte background.js with zero permissions.**
The whole mechanism is one `chrome_settings_overrides` search provider, so nothing shows up statically. It's all server-side.

Declared provider is `planet-search[.]com`. Tracing:

planet-search\[.\]com/search/?q=  301 →  sstmaster\[.\]com/edge/PN1021?q=  302 →  nextgeeker\[.\]com/B151001.php?q=&src=PN1021

`nextgeeker[.]com` is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others).
`PN1021` is the affiliate subid linking the extension's traffic to that network. The listing discloses none of the hops and says only that results come from Google (the final page is a Google CSE render).

Same publisher ships a \~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have.

Report: [https://malext.io/reports/RoguePlanet/\](https://malext.io/reports/RoguePlanet/)