Is China Planet: VIP podpora pre vaše nákupy z Číny safe?

Clean risk

China Planet redirects some shopping product pages through affiliate links that include the page URL.

On Soundcore product pages, the extension forwards the current page URL to Admitad before replacing the page with the affiliate URL. On Geekbuying item pages, it removes existing affiliate tracking parameters and redirects through Geekbuying's affiliate deeplink with the cleaned product URL.

China Planetv1.2.4Chrome Web Store
0Risk
Who publishes it

China Planet - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
China Planet

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Geekbuying product pages are redirected through a partner link first

On a geekbuying.com item page, the extension strips referral params and redirects to affiliate.geekbuying.com/deeplink.php (ID 3983) before the page loads.

It 301s back, sets a 30-day idev cookie, sent on 17 later requests, unannounced.

Severity
Low vulnerability
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a product page on geekbuying.com.

In our test session the address was https://www.geekbuying.com/item, opened with no referral cookie in the browser.

The extension did this

The extension immediately sends the tab to an affiliate link that credits partner 3983, then returns you to the same product page.

The round trip took 0.3 seconds and needed no click or confirmation from you; the page you asked for is the page you end up on, with tracking parameters added.

Captured request
GEThttps://affiliate.geekbuying.com/deeplink.php?affid=3983&sub_id=extension&url=https%3A%2F%2Fwww.geekbuying.com%2Fitem

301 redirect to https://www.geekbuying.com/item?idev_id=3983&idev_subid=extension&utm_source=affiliate.geekbuying.com&utm_medium=affiliate_3983&utm_campaign=3983&utm_content=3983&utm_term=chinaplanet1130349, with two cookies set on the response.

Headers
Cookie
vaya_IsRefreshIP=1; vaya_LastIPCountryCode=GB; vaya_CountryCode=GB; vaya_AreaId=6; vaya_Currency=GBP
Set-Cookie (response)
_s=g1bh2467a7ov9bai7m3nplrt2j; path=/; HttpOnly idev=3983-https%3A%2F%2Fwww.geekbuying.com%2F-0-0--extension-----https%3A%2F%2Fwww.geekbuying.com%2Fitem; expires=Mon, 14-Sep-2026 16:50:28 GMT; Max-Age=2592000; path=/; domain=.geekbuying.com
What the extension put on the wire, and what came back
  • The product page you asked for
    url=https%3A%2F%2Fwww.geekbuying.com%2Fitem

    The address of the page you opened, sent to the affiliate service so it can return you there. The only activity that leaves the browser.

  • Credited partner account
    affid=3983

    A fixed partner number that tells the shop who to pay commission to for anything you buy on this visit.

  • Visit source label
    sub_id=extension

    Distinguishes visits sent by this extension from the same partner's other traffic sources.

  • The partner cookie left in your browser
    idev=3983-https%3A%2F%2Fwww.geekbuying.com%2F-0-0--extension-----https%3A%2F%2Fwww.geekbuying.com%2Fitem; Max-Age=2592000; domain=.geekbuying.com

    Stored on geekbuying.com for 30 days. Purchases made in that time stay credited to the same partner, even if you return on your own later.

  • Affiliate session identifier
    _s=g1bh2467a7ov9bai7m3nplrt2j

    A per-browser identifier set by the affiliate service on the same visit, which lets it recognise the same browser on later requests.

  • Click reference on return
    utm_term=chinaplanet1130349

    A per-click reference the affiliate service appends to the return address, tying this visit to the extension's campaign.

Why you can't catch this in DevTools

The 30-day cookie the affiliate service leaves behind is URL-encoded, so it reads as one long string in the browser's cookie jar. Decoded, it is a record of who gets credited and which page you were sent to.

Decoded value
idev = 3983-https://www.geekbuying.com/-0-0--extension-----https://www.geekbuying.com/itemfield 1  3983                             partner id credited for the visitfield 2  https://www.geekbuying.com/       the shop the partner link pointed atfield 3  0field 4  0field 5  (empty)field 6  extension                        sub-id supplied by the extensionfields 7-10 (empty)field 11 https://www.geekbuying.com/item   the product page originally openedexpires  Mon, 14-Sep-2026 16:50:28 GMT    (Max-Age 2592000 = 30 days)domain   .geekbuying.com                  sent to every geekbuying.com host
The code that does this

The whole content script: check for the partner's parameters, otherwise strip and redirect

Readable version

Same file, annotated

affiliates/geekbuying.js
// affiliates/geekbuying.js — runs at document_start on *://*.geekbuying.com/item*// (manifest.json content_scripts entry #2). Annotated below; the file ships// unminified, so the code text is unchanged apart from these comments.// Helper: returns `url` with the named query parameter removed.function removeQueryParam(url, param) {    // Split the URL into base and query string    const urlParts = url.split('?');    // If there's no query string or the param doesn't exist, return the URL as it is    if (urlParts.length < 2 || url.indexOf(param + '=') === -1) {        return url;    }    const baseUrl = urlParts[0];    const queryString = urlParts[1];    // Split the query string into key-value pairs    const queryParams = queryString.split('&');    // Filter out the parameter to be removed    const filteredParams = queryParams.filter(function (paramPair) {        return paramPair.split('=')[0] !== param;    });    // Reconstruct the query string    const newQueryString = filteredParams.join('&');    // Rebuild the URL    return baseUrl + (newQueryString ? '?' + newQueryString : '');}// The address of the product page the user opened.const url = window.location.href;// GUARD: do nothing only if the address ALREADY carries this partner's full// referral parameter set (partner 3983 or 764, sub-id extension /// xiaomiplanet / kuponovyportal). Any other state — including a competing// partner's parameters — falls through to the redirect branch below.if (    (url.includes("idev_id=764") || url.includes("idev_id=3983"))    &&    (url.includes("idev_subid=xiaomiplanet") || url.includes("idev_subid=kuponovyportal") || url.includes("idev_subid=extension"))    &&    url.includes("utm_source=affiliate.geekbuying.com")    &&    (url.includes("utm_medium=affiliate_764") || url.includes("utm_medium=affiliate_3983"))    &&    (url.includes("utm_campaign=764") || url.includes("utm_campaign=3983"))    &&    (url.includes("utm_content=764") || url.includes("utm_content=3983"))) {    // "url je okej" (Slovak: "the url is okay") — leave the page alone.} else {    // STRIP: remove any referral / campaign parameters already on the address,    // including ones placed there by a different referrer.    let clean_url = removeQueryParam(url, "idev_id");    clean_url = removeQueryParam(clean_url, "idev_subid");    clean_url = removeQueryParam(clean_url, "utm_source");    clean_url = removeQueryParam(clean_url, "utm_medium");    clean_url = removeQueryParam(clean_url, "utm_campaign");    clean_url = removeQueryParam(clean_url, "utm_content");    clean_url = removeQueryParam(clean_url, "utm_term");    // REDIRECT: send the tab through the affiliate service with partner id    // 3983 and sub-id "extension", carrying the cleaned address in `url=`.    const new_url = "https://affiliate.geekbuying.com/deeplink.php?affid=3983&sub_id=extension&url=" + encodeURIComponent(clean_url);    location.replace(new_url);   // top-level navigation, no user interaction}
Hosts involved in the redirect we captured
    • affiliate.geekbuying.com

    Geekbuying's affiliate/deeplink service. Gets the product page address, records the visit for partner 3983, sets a 30-day idev cookie plus a session cookie, and 301s you back.

    • www.geekbuying.com

    The shop itself: the page you asked for, returned to you with idev_id, idev_subid and utm_* appended. Gets the partner cookie on later requests in the session.

What we did not observe

Only the address of the product page left the browser. In the captured session the script did not read cookies, form inputs or page content, used no privileged Chrome APIs, and the manifest confines it to geekbuying.com item pages, so it cannot act on other sites. Affiliate redirection is ordinary behaviour for a shopping-support extension, and the destination is the shop's own affiliate service rather than a third party; what is recorded here is that it happens on every matching page without a prompt, that it replaces referral parameters already on the address, and that the resulting credit persists in your browser for 30 days.

Where it sends data

Destinations our analysis observed China Planet: VIP podpora pre vaše nákupy z Číny contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ad.admitad.com

    China Planet: VIP podpora pre vaše nákupy z Číny sends data to ad.admitad.com. One other extension we have analysed sends data here.

  • affiliate.geekbuying.com

    China Planet: VIP podpora pre vaše nákupy z Číny sends data to affiliate.geekbuying.com. No other extension we have analysed sends data here.

Updated 30 September 2026debjifhejpkmibagfindoopnjkoncabm