Is Agents Links Converter 2026 - Sugargodness safe?

Medium risk

Agents Links Converter 2026 - Sugargodness is medium risk. On CNFans/Oopbuy registration pages, the extension rewrites the referral parameter to its own code: ref=77746 (CNFans), inviteCode=QNXKQBAOB (Oopbuy), reloads. Commission credits the extension, not your referrer. Its other 5 sites don't.

sugargodnessv4.5Chrome Web Store
45Risk
Who publishes it

sugargodness - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
sugargodness
Website
discord.gg/URGEf4x4

Same store account

1 other listing published from this account, 5k+ users between them, none of them carrying a finding.

SugarQC | Search QC Photos on CNFans5k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Hardcoded Affiliate Codes Override Registration Referral Links

On CNFans/Oopbuy registration pages, the extension rewrites the referral parameter to its own code: ref=77746 (CNFans), inviteCode=QNXKQBAOB (Oopbuy), reloads.

Commission credits the extension, not your referrer.

Its other 5 sites don't.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a CNFans or Oopbuy registration page, possibly by following a referral link someone else shared with you.

e.g. https://cnfans.com/register?ref=<someone-elses-code>

The extension did this

The extension's content script reads the page URL and replaces the referral code with its own hardcoded value before the page finishes loading.

The page is reloaded with the new URL via window.location.replace, so no entry is added to your browser history.

Referral codes the extension enforces regardless of what was in the URL you followed
  • CNFans referral code
    ref=77746

    Determines who is credited for referring your account. The extension forces its own code, so commission goes to its operator, not you.

  • Oopbuy invite code
    inviteCode=QNXKQBAOB

    Determines who is credited with inviting you to Oopbuy. The extension forces this to its own code the same way.

Captured request
GEThttps://cnfans.com/register?ref=77746

Registration page reloads with the extension's referral code in place; the ref value that was in the URL before the content script ran is gone.

Captured request
GEThttps://oopbuy.com/register?inviteCode=QNXKQBAOB

Registration page reloads with the extension's invite code in place; the inviteCode value that was in the URL before the content script ran is gone.

The code that does this

The extension's shipped source (not minified), with an annotated walkthrough of the override logic:

Readable version

CNFans handler, annotated

function handleCNFansRegisterUrl() {  try {    const currentUrl = window.location.href;    const url = new URL(currentUrl);    // Only act on CNFans registration pages.    if ((url.hostname === "cnfans.com" && url.pathname.includes("/register")) ||        (url.hostname === "2024.cnfans.com" && url.pathname.includes("/register"))) {      const currentRef = url.searchParams.get("ref");      // If the ref param is missing, or holds anything other than the      // extension's own code, overwrite it.      if (currentRef !== "77746") {        const newUrl = new URL(currentUrl);        if (currentRef) {          newUrl.searchParams.set("ref", "77746");   // replace an existing code        } else {          newUrl.searchParams.append("ref", "77746"); // append when none was present        }        if (reloadAttempted) {          // Second pass: just fix the address bar, no reload.          window.history.replaceState({}, '', newUrl.toString());          setTimeout(() => { showAffiliateNotice(); }, 1000);          return;        }        // First pass: reload the page under the rewritten URL.        // location.replace() does not add a browser-history entry.        reloadAttempted = true;        requestAnimationFrame(() => {          window.location.replace(newUrl.toString());        });      }    }  } catch (error) {    console.error('Error en handleCNFansRegisterUrl:', error);  }}

Oopbuy handler, annotated

function handleOopbuyRegisterUrl() {  try {    const currentUrl = window.location.href;    const url = new URL(currentUrl);    // Only act on Oopbuy registration pages.    if (url.hostname === "oopbuy.com" && url.pathname.includes("/register")) {      const currentInviteCode = url.searchParams.get("inviteCode");      // Same pattern as CNFans, keyed on inviteCode instead of ref.      if (currentInviteCode !== "QNXKQBAOB") {        const newUrl = new URL(currentUrl);        if (currentInviteCode) {          newUrl.searchParams.set("inviteCode", "QNXKQBAOB");        } else {          newUrl.searchParams.append("inviteCode", "QNXKQBAOB");        }        if (reloadAttempted) {          window.history.replaceState({}, '', newUrl.toString());          setTimeout(() => { showAffiliateNotice(); }, 1000);          return;        }        reloadAttempted = true;        requestAnimationFrame(() => {          window.location.replace(newUrl.toString());        });      }    }  } catch (error) {    console.error('Error en handleOopbuyRegisterUrl:', error);  }}
Check if you're affected

Paste into the DevTools console on a CNFans or Oopbuy registration page (with the extension installed) to log every time the page URL is rewritten via location.replace or history.replaceState, showing the before/after referral code.

Requires
  • Chrome with the extension installed
  • DevTools open on the registration page
register-url-override-detector.js · js
// register-url-override-detector.js// Logs any rewrite of the page URL's ref/inviteCode query parameter.(function () {  function paramsOfInterest(url) {    try {      const u = new URL(url, location.href);      return { ref: u.searchParams.get('ref'), inviteCode: u.searchParams.get('inviteCode') };    } catch (e) {      return {};    }  }  const before = paramsOfInterest(location.href);  console.log('[URL_OVERRIDE_DETECTOR] initial params:', before);  const origReplace = window.location.replace.bind(window.location);  window.location.replace = function (url) {    console.log('[URL_OVERRIDE_DETECTOR] location.replace called with:', url, 'params:', paramsOfInterest(url));    return origReplace(url);  };  const origReplaceState = window.history.replaceState.bind(window.history);  window.history.replaceState = function (state, title, url) {    if (url) {      console.log('[URL_OVERRIDE_DETECTOR] history.replaceState called with:', url, 'params:', paramsOfInterest(url));    }    return origReplaceState(state, title, url);  };  console.log('[URL_OVERRIDE_DETECTOR] installed. Reload the register page with a different ref/inviteCode value in the URL to see it get overwritten.');})();
How to run it
  1. 1Open a CNFans/Oopbuy registration URL with a ref/inviteCode, e.g. cnfans.com/register?ref=other-code.
  2. 2Open DevTools Console there.
  3. 3Paste this, press Enter before reload fires.
  4. 4Watch for [URL_OVERRIDE_DETECTOR] log lines.
Updated 30 September 2026pkjccijojognikhopddedmbiebfiihje