Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: goodie cashback

CRITICAL RISKRemoved from Chrome Web Store

goodie cashback

ID: mafkccpgpmndaocnipiaeeebmkgipkap

Could be malicious

Supported Languages

🇺🇸English

🇵🇱Polish

Extension Info & Metadata

Status

Removed

Version

0.0.31

Size

0.44 MB

Rating

3.0/5

Reviews

Users

10,000

Type

Extension

Updated

Jul 12, 2024

Publisher Contextual Analysis

Author: goodie-developerView Profile
Privacy: Privacy Policy
Help: Help Center
Country: PL
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: Stanisława Żaryna 2A Warszawa 02-593 PL

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

Email Change History

1 change

Jun 28, 2024

Domain changed

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Get cashback for online shopping with goodie

Goodie cashback plugin is the perfect solution for your online shopping. You will never forget about cashback. Install a safe plugin for free. It will automatically inform you about the availability of cashback during your shopping!

User Growth

Showing data from Nov 29, 2023 to Dec 05, 2024

Versions

No change in user count

Compared to 4 months ago

6 versions released in this period

Rating Count

Total: 61 ratings+1 (2%)

Average Rating

Current: 3.00 / 5.0+3.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High2

Medium4

Low0

Versions scanned

Showing 1 of 6 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
0.0.24 Code review	6

Extension Version	Code Review Findings
0.0.24	6

Files with findings

2 distinct paths — top paths by unique finding count:

src/pages/background/index.js4
src/pages/content/index.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	src/pages/content/index.js (line 19505)	The content script parses Google and Bing search result pages and injects clickable cashback overlays next to brand-matching results. Clicking these triggers an `ACTIVATE_CASHBACK` message which redirects the user thr…	0.0.24
2	Tracking	high	src/pages/background/index.js (line 194)	The extension hijacks the active tab and silently redirects the user through goodie.pl's affiliate landing page (GOODIE_CASHBACK_LINK), passing the user's original page URL base64-encoded as the `ru` query parameter. …	0.0.24
3	Remote Code Loading	medium	src/pages/background/index.js (line 279)	Background fetches an arbitrary URL (the brand `logo` field returned by goodie.pl's API) and converts the response into a base64 data URL via FileReader. Because the URL comes from the remote API response without orig…	0.0.24
4	Tracking	medium	src/pages/background/index.js (line 51)	Every UI interaction is funneled through a `/telemetry` POST to goodie.pl/api/plugin (Gr in permissions-SOgqhru9.js:4000). Events such as `Plgn-icon`, `common-LikeBrand`, `Plgn-SearchLink`, `Plgn-ActivationDeepLinkMsg…	0.0.24
5	Unauthorized Data Collection	medium	src/pages/background/index.js (line 186)	The background service worker subscribes to `chrome.cookies.onChanged` globally (the API does not allow filtering by domain in the listener registration) and reads the `userId` and `language` cookies from goodie.pl. W…	0.0.24
6	Unauthorized Data Collection	medium	src/pages/content/index.js (line 18380)	The content script reads `window.location.href` from every https site the user visits and forwards it to the background script (which can then send it to goodie.pl via affiliate redirects/telemetry). With `matches: ['…	0.0.24

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


goodie.pl	/api/plugin	https://goodie.pl/api/plugin
goodie.pl	-	https://goodie.pl
github.com	/facebook/react/issues/3236	https://github.com/facebook/react/issues/3236
reactjs.org	/link/special-props	https://reactjs.org/link/special-props
reactjs.org	/link/strict-mode-string-ref	https://reactjs.org/link/strict-mode-string-ref
reactjs.org	/link/invalid-hook-call	https://reactjs.org/link/invalid-hook-call
reactjs.org	/link/warning-keys	https://reactjs.org/link/warning-keys
github.com	/facebook/react/issues	https://github.com/facebook/react/issues
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
*	/*	https:///

Showing 1 to 10 of 60 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


3.73.5.5	IPv4	-
5.4.9.9	IPv4	-
1.2.17.17	IPv4	-
17.17.38.25	IPv4	-
14.16.12.26	IPv4	-
15.14.16.25	IPv4	-
39.39.91.61	IPv4	-
15.17.35.25	IPv4	-
39.86.86.86	IPv4	-
6.14.8.37	IPv4	-
2.24.28.53	IPv4	-

Showing 1 to 11 of 20 rows

Rows per page:

1.5 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Scam jedyne co potrafia napisac to: Nie możemy pozytywnie rozpatrzyć Twojego zgłoszenia, ponieważ wskazana transakcja nie spełnia warunków goodie. SCAM SYF MASAKRA

Krystian Kowalski·4 Jan 2025

Hahaha widzę, że bardzo dużo osób ma ten sam problem co i ja. Wygodna wtyczka, ale wszystkie transakcje są odrzucane, tylko z allegro działa poprawnie. A dalej to wmawianie, że się przeglądało inne oferty, albo ma się adblocka.

Michał Przygocki·30 Nov 2024

Wtyczka działa tylko z allegro, transakcje innych sklepów np. eobuwie, lidl zagineły mimo aktywnej wtyczki i cashbacku.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

goodie cashback

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Email Change History

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 6 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating