Is 🏷️Simple Price Alerts - Price alert for Amazon, Aliexpress, eBay, etc. safe?
Simple Price Alerts loads affiliate tracking URLs on shopping pages and fetches remote boun.me rules that control page hooks.
On matching shopping product pages, the extension can automatically load affiliate tracking URLs after it has been installed for more than 10 days, with the visited product URL included in request parameters. It also fetches seller rules from boun.me, and those remote rules can change which pages and page elements the content script hooks without an extension update.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension auto-fires affiliate-tracking requests on shopping page visits
This extension sends your product-page URL to affiliate networks once installed over 10 days.
On Amazon, Cdiscount, eBay, AliExpress, and 17 other sites it builds an affiliate URL, sent via fetch, iframe, or redirect.
A toggle disables it.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install the extension and, more than 10 days later, browse to a supported shopping site.
The extension's content script runs on every page (<all_urls>) and checks each URL against 21 seller rules, including Amazon, Cdiscount, eBay, and AliExpress.
The extension automatically requests an affiliate-tagged version of the page you're viewing and sends it to a third-party ad-tech network.
Depending on the seller, this happens via a background fetch() call, an off-screen iframe, or a full-page redirect through the extension's own bounce page, with no click or consent prompt shown.
200 OK. Fired automatically by the content script's fetch(product.productUrlAff, {mode:'no-cors', credentials:'include', referrerPolicy:'no-referrer'}) call when the Amazon.fr product page loaded, more than 10 days after install.
302 redirect back to cdiscount.com with an awc= attribution parameter appended (200). The exact Cdiscount product URL visited is embedded in the ued= parameter.
- Product page URL you visitedued=https://www.cdiscount.com/f-1442016-eve1701125697540.html
The exact page you viewed, including its product ID, is embedded in the affiliate request's URL on every matched product page.
- Affiliate/merchant IDawinmid=6948&awinaffid=1154409
An affiliate ID tied to the extension developer's account is attached so the ad network attributes any resulting purchase to them.
- Browsing patternamazon.fr, cdiscount.com, ebay.com, aliexpress.com, and 17 more
Fires automatically on every matched page, not just on a 'buy' click, so the network can see which products you browse across 21 sites.
- awin1.com
AWIN affiliate network. Receives the product page URL via ued= when you view a matched Cdiscount, Fnac, Darty, ManoMano, Geekom, Engwe, or Beelink product page.
- shareasale.com
ShareASale affiliate network. Receives the product page URL via urllink= for other matched sellers in the extension's seller list.
- track.effiliation.com
Effiliation affiliate network. Receives the product page URL via url=.
- ad.admitad.com
Admitad affiliate network, used for AliExpress/Banggood/Geekbuying-style redirects.
- rover.ebay.com
eBay's own Rover affiliate tracker, requested automatically after visiting a matched eBay product page.
- amazon.fr / amazon.com
Amazon retail sites, requested directly with the extension's own affiliate tag= parameter appended.
What it can do
Permissions this extension asks for, as declared in version 1.5.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Show you desktop notifications
notifications
Store data in your browser
storage
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed %F0%9F%8F%B7%EF%B8%8Fsimple-price-alerts-pr contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ad.admitad.com
%F0%9F%8F%B7%EF%B8%8Fsimple-price-alerts-pr sends data to ad.admitad.com. One other extension we have analysed sends data here.
- rover.ebay.com
%F0%9F%8F%B7%EF%B8%8Fsimple-price-alerts-pr sends data to rover.ebay.com. One other extension we have analysed sends data here.
- awin1.com
%F0%9F%8F%B7%EF%B8%8Fsimple-price-alerts-pr sends data to awin1.com. No other extension we have analysed sends data here.
- shareasale.com
%F0%9F%8F%B7%EF%B8%8Fsimple-price-alerts-pr sends data to shareasale.com. No other extension we have analysed sends data here.
- track.effiliation.com
%F0%9F%8F%B7%EF%B8%8Fsimple-price-alerts-pr sends data to track.effiliation.com. No other extension we have analysed sends data here.