Is BuyHatke safe?

Question

Is BuyHatke safe?

Accepted Answer

BuyHatke is medium risk. Code analysis confirms the extension's service worker installs a chrome.webRequest.onBeforeSendHeaders listener on all requests to be.mcdelivery.co.in (McDonald's India delivery backend) using the extraHeaders flag, which grants access to the Authorization header normally withheld from extensions. When a request carries an Authorization: JWT <token> header and the decoded JWT payload has is_guest set to true, the token is extracted and stored in chrome.storage.local under the key foodCompareMcdGuestJwt along with its expiry time and capture timestamp. A declarativeNetRequest rule (Rule 34) on the same endpoint simultaneously rewrites the Origin and Referer headers to impersonate the McDelivery web client, enabling the extension to call McDelivery backend APIs while appearing to be the legitimate site.

Is Buyhatke: Price History & Tracker, Spend Lens safe?

Findings