Is DirectStayz: Book hotels directly, save money and unlock benefits safe?
DirectStayz sends Booking.com hotel page URLs to Plausible and can rewrite search-result links through Awin.
When you open a Booking.com hotel page, the extension records that page load and sends the full page URL to a Plausible analytics endpoint configured for DirectStayz. On Booking.com search results, remote configuration can enable affiliate rewriting so hotel links are replaced with Awin tracking URLs.
Who publishes itmatcha.squad1 - no other listings under this identity, 2 shared hostnames
matcha.squad1 - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
DirectStayz sends the Booking.com hotel page URL to an analytics server
Opening a Booking.com hotel page makes DirectStayz send the page URL to plausible-1.matcha-squad.xyz, the developer's analytics server, with no consent prompt.
The captured POST carries the exact hotel URL; no cookies or form data are sent.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to a Booking.com hotel listing page.
The extension's content script for hotel pages is injected as the page loads.
The full URL of the page you're viewing is sent to a server the developer operates.
This happens automatically on every matching page load, with no consent prompt shown first.
HTTP 202 Accepted, no response body, Plausible's event-collection endpoint is fire-and-forget.
{ "domain": "extension-1.directstayz.com", "name": "booking.com:hotel-page-loaded", "url": "https://www.booking.com/hotel/fr/lademeure_paris.html", "props": {}}- Page URLhttps://www.booking.com/hotel/fr/lademeure_paris.html
The exact Booking.com hotel page you were viewing, including the hotel's URL slug.
- Event namebooking.com:hotel-page-loaded
A fixed label identifying this as a hotel-page-view event, distinct from other events the extension logs.
- Analytics project domainextension-1.directstayz.com
A tag the developer configured so events from this extension are grouped together on their analytics server.
Reading the page URL and sending it to the analytics endpoint
Content script reports the page load
assets/index.ts-BKM0ehae.jsasync function reportHotelPageLoaded() { try { dynamicConfig = await Config.getConfig(); logger.debug(`Dynamic config: ${JSON.stringify(dynamicConfig, null, 2)}`); const currentUrl = window.location.href; vendors.plausible.logEvent({ name: "booking.com:hotel-page-loaded", url: currentUrl, props: {} }); if (document.readyState === "loading") { document.addEventListener("DOMContentLoaded", startReserveButtonWatcher); } else { startReserveButtonWatcher(); } } catch (e) { sentry.captureException(e); }}Shared logEvent() helper builds and sends the POST
assets/vendors-Ri7_B-Y6.jsasync function logEvent(eventProps, useBackgroundScript = true) { const eventBody = { domain: config.static.vendors.plausible.DOMAIN, // "extension-1.directstayz.com" ...eventProps }; const request = { method: "POST", url: `${config.static.vendors.plausible.URL}/api/event`, // "https://plausible-1.matcha-squad.xyz/api/event" data: eventBody }; if (useBackgroundScript) { // Relayed through the service worker so the request doesn't // originate from the content script's own page context. const response = await backgroundScript.axiosFetch(request); return response; } return await axios(request);}- plausible-1.matcha-squad.xyz
Self-hosted Plausible run by the developer (matcha-squad.xyz also hosts pocketbase-1 and glitchtip-1). Receives the page-load event and URL, tagged to the directstayz.com project.
What it can do
Permissions this extension asks for, as declared in version 1.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on api.getdirecto.com
https://api.getdirecto.com/*
Store data in your browser
storage
Where it sends data
Destinations our analysis observed DirectStayz: Book hotels directly, save money and unlock benefits contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.awin1.com
DirectStayz: Book hotels directly, save money and unlock benefits sends data to www.awin1.com. 4 other extensions we have analysed send data here.
- plausible-1.matcha-squad.xyz
DirectStayz: Book hotels directly, save money and unlock benefits sends data to plausible-1.matcha-squad.xyz. No other extension we have analysed sends data here.