Is Buyhatke: Price History & Tracker, Spend Lens safe?

function K(e) {  for (let r of u(e.containerSelector)) {    let t = [];    try {      t = Array.from(document.querySelectorAll(r))    } catch {}    let n = [];    for (let l of t)      for (let i of u(e.rowSelector)) try {        let o = Array.from(l.querySelectorAll(i));        if (!o.length) continue;        let a = o.filter(c => g(c, e.labelSelector));        a.length > n.length && (n = a)      } catch {}    if (n.length) return n  }  return []}

async function v(e, r) {  try {    let t = K(r);    if (!t.length) return !1;    let {      rowLines: n,      extraLines: l    } = G(r, t);    if (!n.length) return !1;    let i = [...n, ...l],      o = JSON.stringify(i);    if (o === m) return !0;    let a = await T(r, e);    a.length || (a = [""]);    for (let c of a) await S({      type: "postGroceryCd",      data: {        pos: e,        storeId: c,        info: i      }    });    return m = o, !0  } catch {    return !1  }}

const IDENTITY_INIT_URL   = "https://ch.buyhatke.com/bhs/identity/init";const IDENTITY_UPDATE_URL = "https://ch.buyhatke.com/bhs/identity/update";const LOCALSTORAGE_KEY_PROFILE_ID = "bhk_cid";const COOKIE_NAME_PROFILE_ID      = "bhacls";const LOCALSTORAGE_KEY_LAST_UPDATE = "bhk_profile_updated_at";const UPDATE_INTERVAL_MS = 1440 * 60 * 1000; // 24 hours

// body 'o' carries: { siteId, platform, appId?, userCity?, userCountry?, userState?, userPincode? }const response = await fetch(IDENTITY_INIT_URL, {  method: "POST",  headers: { "Content-Type": "application/json" },  body: JSON.stringify(locationPayload),  credentials: "include"});const result = await response.json();const profileId = result.profileId ?? result.data?.profileId               ?? result.userId ?? result.clsId ?? result.data?.userId ?? result.data?.clsId;if (profileId) {  setLocalStorage(LOCALSTORAGE_KEY_PROFILE_ID, profileId);  setCookie(COOKIE_NAME_PROFILE_ID, profileId, /* days = */ 365);}return profileId;

const BUYHATKE_PUBLIC_KEY_B64 = "BH+ntgHuMS45p27DNsYJ6zSmLsFB2gH6io+QW6aQpSKRW/R0EFaFWFbtHU31Z57FUUiZmcvkxymr+Vm6JcUxu44="; // hardcoded, non-secret EC public key baked into the bundleasync function encryptContextPayload(payload) {  const subtle = window.crypto?.subtle;  const serverPublicKey = await subtle.importKey("raw", base64Decode(BUYHATKE_PUBLIC_KEY_B64),    { name: "ECDH", namedCurve: "P-256" }, false, []);  const ephemeralKeyPair = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);  const sharedSecret = await subtle.deriveBits({ name: "ECDH", public: serverPublicKey }, ephemeralKeyPair.privateKey, 256);  const aesKey = await subtle.importKey("raw", sharedSecret, { name: "AES-GCM" }, false, ["encrypt"]);  const iv = crypto.getRandomValues(new Uint8Array(12));  const plaintext = new TextEncoder().encode(JSON.stringify(payload)); // payload.html = the full page HTML  const ciphertext = await subtle.encrypt({ name: "AES-GCM", iv }, aesKey, plaintext);  const ephemeralPublicKeyRaw = await subtle.exportKey("raw", ephemeralKeyPair.publicKey);  return base64Encode(JSON.stringify({    epk: base64Encode(ephemeralPublicKeyRaw), // ephemeral public key, for the server to re-derive the shared secret    iv:  base64Encode(iv.buffer),    ed:  base64Encode(ciphertext)              // encrypted { publicKey, url, slotId, width, height, html, keywords }  }));}async function saveContext(encryptedBlob, apiBase) {  await fetch(`${apiBase}/api/v1/context/save`, {    method: "POST",    headers: { "Content-Type": "application/json" },    body: JSON.stringify({ d: encryptedBlob })  });}

async function bl() {  try {    let e = "Chrome", t = 0, r = navigator.userAgent || navigator.vendor || window.opera;    // Platform detection (Chrome / Edge / Safari / Firefox / Android) ...    await _.setItem("userPlatform", e);    await _.setItem("isMobilePlatform", t);    let a = "";    try {      // Primary IP lookup      a = await (await fetch("https://checkip.amazonaws.com/")).text();      a = a.split("\n").join("");    } catch {      // Fallback IP lookup      a = await (await fetch("https://api.ipify.org/")).text();      a = a.split("\n").join("");    }    // Geolocation resolve — plain HTTP (not HTTPS)    let i = await (await fetch("http://ip-api.com/json/" + a)).json(),      o = i?.city,      l = i?.country;    if (o && l) {      await _.setItem("userCity", o);      await _.setItem("userCountry", l);    }  } catch {}}bl(); // runs immediately on startupsetInterval(function() { bl(); }, 24 * 3600 * 1000); // repeats every 24 hours