Is Daily Deals safe?
Daily Deals is medium risk. On every browser startup, Daily Deals sends its toolbar version to a BeFrugal server and gets back flags like ToolbarToUninstall. In this build the response is parsed but not observed to be acted on.…
Who publishes itbefrugaldev - 2 other listings from the same operator, 2 of them carrying a finding
befrugaldev - 2 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 120k+ users between them. 2 of them carry a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Daily Deals reports its version to BeFrugal on every browser startup
On every browser startup, Daily Deals sends its toolbar version to a BeFrugal server and gets back flags like ToolbarToUninstall.
In this build the response is parsed but not observed to be acted on.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You start Chrome, or the browser wakes the extension's background service worker.
Daily Deals reports its toolbar version to a BeFrugal server over HTTPS and receives a JSON object of behavior-control flags in return.
The response we captured named fields including ToolbarToUninstall and CleanupMode, describing remote control over whether the toolbar resets or removes itself.
HTTP 200, JSON body: {"NeedsUpgrade":false,"ToolbarToUninstall":false,"CleanupMode":true,"ShowWhenCleanup":false,"AutoKeepChanges":true}. Observed on both an install replay and a subsequent startup replay in the same session.
- Content-Type
- application/x-www-form-urlencoded
toolbarversion=ch-dd2-3.0.14&justInstalled=false- Force uninstallToolbarToUninstall: false
A true value here would tell the extension to remove the toolbar. We observed it as false and never saw it acted on.
- Cleanup modeCleanupMode: true
Signals whether the extension should enter a settings cleanup or reset state.
- Update requiredNeedsUpgrade: false
Tells the extension whether the server considers the installed version out of date.
- Keep changes automaticallyAutoKeepChanges: true
Would control whether browser settings changes the toolbar makes are kept without a prompt.
The settings fetch, shipped vs. readable
Pretty-printed, same logic
background.jsnamespace.storage.local.get("ddversion", function(a) { fetch("https://tbwsjs.befrugal.com/wssimple.asmx/GetDailyDealsSettings", { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: "toolbarversion=" + a.ddversion + "&justInstalled=false" }).then(function(a) { return a.ok ? a.json() : null // parsed here, but nothing chains onto this promise })})On every browser startup
Fires on every onStartup and onInstalled browser lifecycle event, not on a recurring timer.
Daily Deals mints a persistent token and resends it to BeFrugal hourly
On install, Daily Deals fetches a persistent UserToken from BeFrugal and reports it back immediately.
A recurring hourly alarm then resends the same token to a separate BeFrugal endpoint indefinitely.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install Daily Deals for the first time.
The extension fetches a persistent UserToken from a BeFrugal server, caches it locally, and reports it straight back to a different BeFrugal endpoint.
From then on, a repeating browser alarm resends the same token to a third BeFrugal endpoint once every hour, for as long as the extension is installed.
HTTP 200. Response body returns a fresh UserToken/UserName pair, confirming the server tracks this identifier server-side across requests.
- Content-Type
- application/x-www-form-urlencoded
toolbarversion=ch-dd2-3.0.14&usertoken=<redacted>Every 1 hour
chrome.alarms fires 'RegenDB' once per hour; each firing checks a stored date and, if the day has changed, resends the token.
The hourly resend, shipped vs. readable
Pretty-printed, same logic
background.jschrome.alarms.onAlarm.addListener(function(a) { if (a.name === "RegenDB") { chrome.storage.local.get(["digestDate", "ddversion"], function(state) { const alreadySentToday = state.digestDate === (new Date).toLocaleDateString(); if (!alreadySentToday) { chrome.storage.local.set({ digestDate: (new Date).toLocaleDateString() }); getUserToken(function(token) { digest.getDigestPartial(token, state.ddversion, false); // POSTs the same persistent token again }); } }); }});- www.befrugal.com
Issues the persistent UserToken and records the install event via the Notify endpoint. BeFrugal's own domain.
- partialjs.befrugal.com
Receives the same token every hour via the RetailerDigestPartial cashback-digest endpoint. BeFrugal's own domain.
What it can do
Permissions this extension asks for, as declared in version 3.0.14. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on befrugal.com
*://*.befrugal.com/*
Read and change your data on yahoo.com
*://*.yahoo.com/*
Add items to the right-click menu
contextMenus
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
Schedule its own background tasks
alarms
Run searches with your default search engine
search