Chart Trader - Tracking Multiple Charts

The extension silently sends the user's real IP address to a third-party geolocation service (iplocate.io) every time the popup is opened, with no disclosure or consent mechanism. This exposes the user's IP and inferred geographic location to an external party that is not the declared publisher, constituting covert user tracking.

$.getJSON('https://www.iplocate.io/api/lookup', function(data) {  if ((data && data.country_code == "VN") || !data.country_code) {    $('#accordion .card#6')      .show();  }});

The extension fetches ad content from a remote server-controlled API endpoint and injects it into the popup via jQuery's `.html()`, which parses and renders arbitrary HTML. A malicious or compromised API response could inject event-handler attributes (e.g., `onerror`) that execute JavaScript inside the extension popup's privileged context, or silently redirect users to attacker-controlled URLs via the `data.link` click handler.

$.getJSON(url_api + 'api/popup-ads/', function(data) {  if (data.img && data.link) {    $('#banner-ads')      .html('<img alt="" width="100%" src="' + data.img + '">');    $('#banner-ads')      .click(function(event) {        window.open(data.link, '_blank');      })  }});

Commented-out code shows a complete cookie-access function targeting arbitrary domains via `chrome.cookies.get`. While not currently active, this indicates the extension was designed to harvest authentication cookies from visited sites; the function scaffolding is ready to be re-enabled by a server-pushed update or future version.

// function getCookies(domain, name, callback) {//     chrome.cookies.get({"url": domain, "name": name}, function(cookie) {//         if(callback) {//             if(cookie != null && cookie.value != null){//                 callback(cookie.value);//             }//         }//     });// }

On first install the extension silently opens an external marketing URL with UTM tracking parameters, confirming that the publisher identifies and tracks individual install events without user initiation or consent.

chrome.runtime.onInstalled.addListener(function(details) {  if (details.reason == "install") {    window.open('https://www.chart-trader.com/?utm_campaign=extension&utm_medium=chrome&utm_source=install');  }});