Is Elegant safe?

High risk

Elegant is high risk. When you submit a search from Elegant's new-tab page, the extension navigates to search.becovi.com with your search terms, its runtime ID, and a stored affiliate value. DA loaded the page but didn't trigger a submit, capturing no request.

StyleNetv1.0.2Chrome Web Store

75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH

ClassUNWANTED

TypeUnexpected

CWECWE-359

SourceAI SANDBOX

New-tab searches redirect with extension and affiliate IDs

When you submit a search from Elegant's new-tab page, the extension navigates to search.becovi.com with your search terms, its runtime ID, and a stored affiliate value.

DA loaded the page but didn't trigger a submit, capturing no request.

01EvidenceCAUSE EFFECT

What actually happens

You did this

You submit a search from Elegant's replacement new-tab page.

The page contains a form with a search input and a submit button.

The extension did this

The extension redirects the browser to search.becovi.com with the search terms and tracking values in the URL.

The code adds the typed query, the extension runtime ID, and a stored affiliate value named atr.

02EvidenceFIELD TABLE

Values placed into the search redirect URL

Field	Value	Why it matters
Your search terms	weather tomorrow	The words you type into the new-tab search box are sent as part of the redirected search URL.
Extension identifier	ekmdcgonpndmaifohgbdppdbhjjijkng	This identifies which Chrome extension produced the redirect.
Affiliate value	org	This can associate the redirected search with an install source or affiliate channel stored by the extension.

03EvidenceNETWORK CAPTURE

Captured request

GEThttps://search.becovi.com/serp.php?q=weather%20tomorrow&s=ekmdcgonpndmaifohgbdppdbhjjijkng&atr=org

No submitted-search response body was recorded; this URL shows the request shape constructed by the shipped code, with an illustrative search term and the code's literal atr fallback.

04EvidenceCODE COMPARE

The code that does this

The new-tab search form

What it actually does

Show shipped source

Search form in the replacement new-tab pageindex.html

<form id="search">
  <div class="input-group mb-3">
    <input type="text" id="search_input" class="form-control" placeholder="Search here" aria-describedby="button-search">
    <button class="btn bg-primary btn-outline-primary" type="submit" id="button-search"><img src="magnifier.svg" /></button>
  </div>
</form>

05EvidenceCODE COMPARE

The code that does this

The new-tab redirect handler

What it actually does

Show shipped source

Submit handler that builds the redirect URLindex.js

window.addEventListener('load', function load(event) {
    chrome.topSites.get(function (data) {
        for (let i = 0; i < data.length; i++) {
            const url = new URL(data[i]['url']);

            let site = document.createElement('div');
            site.className = 'col site';

            let favicon = document.createElement('img');
            favicon.src = "https://www.google.com/s2/favicons?domain=" + encodeURIComponent(url.host);

            let site_name = document.createElement('span');
            site_name.className = 'site_name';
            site_name.innerText = url.host;

            site.appendChild(favicon);
            site.appendChild(site_name);

            site.addEventListener('click', function(el) {
                window.location.href =  data[i]['url'];
            });

            document.querySelector('#top_sites').appendChild(site);
        }
    });

    document.querySelector('#search').addEventListener('submit', function (el) {
        el.preventDefault();
        let keywords = document.querySelector('#search_input').value;
        chrome.storage.sync.get(['atr'], function(data){
            window.location.href = 'https://search.becovi.com/serp.php?q='+encodeURIComponent(keywords)+'&s='+encodeURIComponent(chrome.runtime.id)+'&atr='+(data['atr'] || 'org');
        });

    });

    showClock();
    setInterval(function(){
        showClock();
    },60000);

    builBackgroundImageOptions();
});

06EvidenceCODE COMPARE

The code that does this

Install-time affiliate value storage

What it actually does

Show shipped source

Install handler fetches and stores atrservice_worker.js

function trackInstall(details) {
    var now = Date.now() / 1000;
    if (details.reason == "install") {
        chrome.storage.sync.set({
            'installed_at' : now
        }, function() {});


        var url = 'https://mattinastazione.com/c.php?id=0021';
        fetch(url, {credentials: 'include'}).then(response => {
            var url = 'https://mattinastazione.com/g.php?id=0021';
            fetch(url, {credentials: 'include'}).then(response => response.text()).then(response => {
                chrome.storage.sync.set({
                    'atr': response
                }, setUninstallURL);
            });
        });
    }
}

Uninstall URL also reads the stored atr valueservice_worker.js

function setUninstallURL() {

    chrome.storage.sync.get(['installed_at','atr'], function(data){
        var url = 'https://www.ntelegant.com/uninstalled.php?extid='+chrome.runtime.id;
        if (data['installed_at']) {
            url += '&ts='+data['installed_at']
        }
        if (data['atr']) {
            url += '&atr='+encodeURIComponent(data['atr']);
        }
        chrome.runtime.setUninstallURL(url);
    });
}

07EvidenceTHIRD PARTY LIST

Remote hosts involved in the flow

search.becovi.com
Receives the new-tab search redirect URL containing the search terms, extension ID, and affiliate value.
mattinastazione.com
Provides the install-time affiliate value that service_worker.js stores as atr in synced browser storage.
www.ntelegant.com
Receives extension uninstall pings with the extension ID, install timestamp, and stored affiliate value when present; also serves new-tab background images observed during DA.