Is Amazon Coupon Auto-Apply safe?

Medium risk

Amazon Coupon Auto-Apply rewrites the affiliate tag on Amazon page loads using a tag fetched from couponhacker.xyz.

On every top-level navigation to an Amazon site, the extension fetches a tag and settings from www.couponhacker.xyz and redirects the tab with that tag in the URL. It replaces an existing affiliate tag unless the server settings say to keep it, and this happens whether or not a coupon is applied. The bundled default is inactive, so behavior depends on the server response.

Strong link to a flagged operator: 1 of the 1 other listing from the same operator is rated high or critical for malicious behaviour. Flagged: Coupon Hacker (high).

couponhackerxyzv1.0.3Chrome Web Store
49Risk
Who publishes it

couponhackerxyz - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
couponhackerxyz
Website
www.couponhacker.xyz/

Same store account

1 other listing published from this account, 8k+ users between them. 1 of them carries a finding.

Coupon Hacker8k+High

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Amazon links are rewritten to carry a vendor affiliate tag from a remote server

Code analysis shows the extension fetches an affiliate tag from couponhacker.xyz and rewrites Amazon page loads to include it, replacing an existing tag when the server config allows.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Static analysis
What actually happens
You did this

You open an Amazon page, even without using any coupon feature.

The extension did this

The tab is redirected to the same URL with the vendor's affiliate tag attached.

An existing tag is replaced when the server config does not preserve it.

Server-controlled settings read from the sync response
  • Affiliate tag
    tag=<vendor tag from server>

    The tag value added to your Amazon URLs; set by the server.

  • Regional tags
    regions: {"co.uk": "<tag>"}

    Per-storefront tag overrides, keyed by Amazon domain suffix.

  • Active flag
    active: true

    Switches the redirect on or off remotely.

  • Preserve flag (cfg.p)
    cfg.p: false

    If unset, another site's tag in your URL gets overwritten.

  • Session limits
    cap, w, i

    Caps and gaps between redirects; the server tunes how often it fires.

The code that does this

Tag overwrite and tab redirect

Readable version

Same logic, formatted

background.js
              if (a.i && e.lastSession) {                const o = 60 * a.i * 1e3;                if (t - e.lastSession < o) return !1              }              return !0            }()) return;          const i = t.searchParams.get("tag");          if (i && c.cfg?.p) return;          let m = "";          t.hostname.toLowerCase().includes("amazon.") && (m = t.hostname.toLowerCase().split("amazon.")[1] || "");          const d = m && c.regions && c.regions[m] ? c.regions[m] : c.value;          if (!d) return;          if (i === d) return;          t.searchParams.set("tag", d);          const p = t.toString();          if (p !== a) {            try {              await chrome.tabs.get(e)            } catch (a) {              return            }            try {              await chrome.tabs.update(e, {                url: p              }), await async function() {
The code that does this

Remote config is parsed from the sync response

Readable version
background.js
const o = await t.json(),              n = {                value: o.tag,                version: o.version,                active: o.active,                timestamp: o.timestamp || Date.now(),                regions: o.regions,                cfg: o.cfg || void 0,
Where the extension connects
    • www.couponhacker.xyz

    Serves the affiliate tag and redirect settings; the same host serves a deals list.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Amazon Coupon Auto-Apply contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.couponhacker.xyz

    Amazon Coupon Auto-Apply sends data to www.couponhacker.xyz. No other extension we have analysed sends data here.

Updated 15 October 2026keibiehbepdjbbfeackcmhoejfknfnnb