Is BuyHatke safe?

Question

Is BuyHatke safe?

Accepted Answer

BuyHatke is medium risk. Code analysis confirms the extension's content script (dominosContentScript.js) runs at document_start on https://m.dominos.co.in/* and reads Dominos checkout bootstrap data from chrome.storage.session. When a pending cart record is present, the script writes session credentials — including an access token, user ID, and mobile number — directly into the Dominos website's localStorage, then triggers window.location.reload() to activate the injected state. The data originates from the extension's Food Compare feature, which stores Dominos session credentials in chrome.storage.session when the user initiates a cross-platform cart comparison checkout. Code analysis confirms the extension's service worker installs a chrome.webRequest.onBeforeSendHeaders listener on all requests to be.mcdelivery.co.in (McDonald's India delivery backend) using the extraHeaders flag, which grants access to the Authorization header normally withheld from extensions. When a request carries an Authorization: JWT <token> header and the decoded JWT payload has is_guest set to true, the token is extracted and stored in chrome.storage.local under the key foodCompareMcdGuestJwt along with its expiry time and capture timestamp. A declarativeNetRequest rule (Rule 34) on the same endpoint simultaneously rewrites the Origin and Referer headers to impersonate the McDelivery web client, enabling the extension to call McDelivery backend APIs while appearing to be the legitimate site.

Is Buyhatke: Price History & Tracker, Spend Lens safe?

Findings