Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: DealFinder by VoucherCodes

CRITICAL RISKRemoved from Chrome Web Store

DealFinder by VoucherCodes

ID: jhgicjdnnonfaedodemjjinbgcoeiajo

Could be malicious

Supported Languages

🇬🇧British English

Extension Info & Metadata

Status

Removed

Version

2.6.1

Size

0.83 MB

Rating

4.7/5

Reviews

Users

100,000

Type

Extension

Updated

Jan 4, 2025

Publisher Contextual Analysis

Trusted

Author: https://vouchercodes.co.ukView Profile
Privacy: Privacy Policy
Help: Help Center
Country: GB
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Address: Yeoman House Sekforde Street London EC1R 0HF GB
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

100,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Automatically find and apply voucher codes when you shop online.

Fed up of hunting for deals? Now you don’t have to! DealFinder by VoucherCodes makes saving money easy by finding the very best discount codes and rewards available for you when you shop online. Join the millions of VoucherCodes members who saved over £63m in 2023, and get access to big discounts you won’t find anywhere else. VoucherCodes adds over 70,000 offers every month, so install DealFinder to make sure you never miss out on a saving again. Simply click on the DealFinder button during checkout and DealFinder will show you the best voucher codes to apply to your shopping basket. No more searching for promo codes, just sit back and let us do the hard work for you. ----------------------------------------------------------------- By using this add-on, you agree to the VoucherCodes Terms & Conditions available at: https://www.vouchercodes.co.uk/legal/terms-and-conditions VoucherCodes Privacy Notice is available at: https://www.vouchercodes.co.uk/legal/privacy-notice

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 4 months ago

13 versions released in this period

Rating Count

Total: 82 ratings

Average Rating

Current: 4.82 / 5.0+0.02

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High3

Medium2

Low1

Versions scanned

Showing 1 of 40 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.4.1 Code review	6

Extension Version	Code Review Findings
2.4.1	6

Files with findings

1 distinct path — top paths by unique finding count:

background_chrome.js6

S.No.	Category	Severity	File	Summary	Found in Version
1	Obfuscation	high	background_chrome.js (line 14834)	Hard-coded list of competitor Chrome extension identifiers stored as base64 strings whose plaintext IDs are recovered by a bespoke every-other-character decoder (see line 14872). Obfuscating identifiers that would oth…	2.4.1
2	Tracking	high	background_chrome.js (line 12028)	Classic affiliate 'cookie stuffing': when the user visits certain merchants (hard-coded allowlist Mo), the extension calls the VoucherCodes recordClick endpoint, receives a bounceURL, and silently fetches it / loads i…	2.4.1
3	Unauthorized Data Collection	high	background_chrome.js (line 14865)	Probes for the presence of competitor browser extensions by requesting their web_accessible_resources via fetch('chrome-extension://<id>/...'), then exfiltrates the list of detected competitors to the backend through …	2.4.1
4	Tracking	medium	background_chrome.js (line 12006)	Listener bound via browser.tabs.onUpdated that auto-closes the hidden affiliate cookie-drop tab as soon as it finishes loading, leaving no visual trace of the commission-dropping request. The pattern (create pinned in…	2.4.1
5	Tracking	medium	background_chrome.js (line 14709)	Enumerates URLs of every currently-open tab (browser.tabs.query({})), filters them for store/marketing parameters, and submits the derived install-tracking data plus marketing_source/campaign/medium/term to the Snowpl…	2.4.1
6	Tracking	low	background_chrome.js (line 11243)	Registers every install with the VoucherCodes backend and receives a persistent userID/installationToken that is later used to stitch Snowplow analytics, graphQL user queries, and cookie-drop recordClick calls into a …	2.4.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


notify.bugsnag.com	-	https://notify.bugsnag.com
sessions.bugsnag.com	-	https://sessions.bugsnag.com
tinyurl.com	/yy3rn63z	https://tinyurl.com/yy3rn63z
github.com	/bugsnag/bugsnag-js	https://github.com/bugsnag/bugsnag-js
127.0.0.1	-	http://127.0.0.1:8000/
a.rmntest.com	-	http://a.rmntest.com/
*	/*	http:///
*	/*	https:///
example.com	/logo.png	https://example.com/logo.png
www.bestbuy.com	-	https://www.bestbuy.com

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-
49.131.49.168	IPv4	-
1.176.13.6	IPv4	-
143.235.199.186	IPv4	-
1.32.224.4	IPv4	-
212.183.34.223	IPv4	-
1.156.39.106	IPv4	-
7.142.48.46	IPv4	-
2.26.97.66	IPv4	-
115.31.145.252	IPv4	-
137.102.109.74	IPv4	-
1.14.15.206	IPv4	-
12.131.229.222	IPv4	-
192.14.213.241	IPv4	-

Showing 1 to 14 of 20 rows

Rows per page:

4.1 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

This is FRAUD. Just like every other coupon extension, DealFinder steals money from small creators by swapping in their own affiliate cookies when you try to find coupons. This website earns a commission on every purchase you make, then chucks pennies worth in "rewards" at your face as a consolation prize for helping them steal another $35. This steals from the hard working individuals who rely on their audience and affiliate marketing to earn a living and pay bills. This is the same garbage as honey. Search YouTube for "Exposing the Honey Influencer Scam"

Tommy Lee·25 Dec 2024

Recommend to add auto-close on the popup, with user-defined countdown time...

Alson P·15 Oct 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

DealFinder by VoucherCodes

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 40 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating