Is FashionReps Link Converter safe?

Medium risk

FashionReps Link Converter rewrites shopping and registration pages to URLs with hardcoded referral codes.

When automatic conversion is enabled, the extension watches shopping navigations and redirects matching product links to supported agent sites with embedded referral, invite, promotion, or partner codes. It also rewrites registration visits on services such as CSSBuy, CNFans, MuleBuy, and ACBuy to referral-code registration URLs.

Discovery Toolsv1.32Chrome Web Store
46Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Registration Links Rewritten With Hardcoded Referral Codes

When you visit a registration page on a proxy-shopping site like CSSBuy or CNFans, the service worker rewrites the destination with the developer's referral code by default, without a prompt. cssbuy.com/register redirected with that code.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You navigate to a supported site's registration page, for example cssbuy.com/register.

No product link or conversion action is involved; you typed or clicked the site's own URL.

The extension did this

The service worker replaces the tab's destination with a URL carrying the developer's referral or invite code before the page loads.

The substitution happens by default; the extension's auto-convert setting is enabled on install.

Captured request
GEThttps://www.cssbuy.com/login/register?pageType=create&inviter=Zerendippity1526

Captured as the immediate destination of a navigation to https://cssbuy.com/register, before any other CSSBuy asset loaded. The inviter parameter matches, character for character, the base64-decoded form of the invite value embedded in the extension's source (WmVyZW5kaXBwaXR5MTUyNg==).

The code that does this

The listener that rewrites the tab, and the hardcoded referral map it draws from.

Readable version

The redirect listener

// Fires on every request the extension can see (host_permissions cover 20+ sites).chrome.webRequest.onBeforeRequest.addListener((details) => {  chrome.storage.sync.get(['autoConvertEnabled', 'defaultSite'], (settings) => {    if (!settings.autoConvertEnabled) return;    const url = details.url;    // Registration/login pages are rewritten to a hardcoded referral URL    // regardless of what the user actually typed or clicked.    if (url.includes('cssbuy.com/register')) {      chrome.tabs.update(details.tabId, { url: 'https://cssbuy.com/register?invite=WmVyZW5kaXBwaXR5MTUyNg==' });      return;    }    if (url.includes('cnfans.com/register')) {      chrome.tabs.update(details.tabId, { url: 'https://cnfans.com/register/?ref=185621' });      return;    }    if (url.includes('mulebuy/register')) {      chrome.tabs.update(details.tabId, { url: 'https://mulebuy.com/register/?ref=200006142' });      return;    }    if (url.includes('acbuy/login')) {      chrome.tabs.update(details.tabId, { url: 'https://acbuy.com/login?loginStatus=register&code=J285SD' });      return;    }  });}, { urls: ['<all_urls>'] });

The hardcoded per-site referral map

// Every supported destination site has a referral/invite code baked in.// The user is not shown or asked to confirm any of these values — they// are stamped onto the URL the tab gets redirected to.const conversionMappings = {  superbuy:    'https://www.superbuy.com/en/page/buy/?url=...&partnercode=FashionReps',  cnfans:      'https://cnfans.com/product/?shop_type={{itemSourceSite}}&id={{itemID}}&ref=185621',  lovegobuy:   'https://www.lovegobuy.com/product?id={{itemID}}&shop_type={{itemSourceSite}}&invite_code=HDZKKJ',  cssbuy:      'https://cssbuy.com/item{{itemSourceSite}}{{itemID}}.html?promotionCode=677e36ace374be6b',  allchinabuy: 'https://www.allchinabuy.com/en/page/buy/?...&partnercode=wrOgUB',  hoobuy:      'https://hoobuy.com/product/{{itemSourceSite}}/{{itemID}}?...&inviteCode=5EAx3zDX',  oopbuy:      'https://oopbuy.com/product/{{itemSourceSite}}/{{itemID}}?inviteCode=5437MXW8P',  pandabuy:    'https://www.pandabuy.com/product?ra=323&url=...&inviteCode=FashionReps',  joyagoo:     'https://joyagoo.com/product/?shop_type={{itemSourceSite}}&id={{itemID}}&ref=200005368',  mulebuy:     'https://mulebuy.com/product/?shop_type={{itemSourceSite}}&id={{itemID}}&ref=200006142',  sugargoo:    'https://www.sugargoo.com/#/home/productDetail?productLink=...&memberId=1325437455988224668',  hagobuy:     'https://www.hagobuy.com/item/details?url=...&affcode=fashionrep',  orientdig:   'https://orientdig.com/product/?shop_type={{itemSourceSite}}&id={{itemID}}&ref=7248594216',  kameymall:   'https://www.kameymall.com/purchases/search/item?url=...&code=41515',  basetao:     'https://www.basetao.com/best-taobao-agent-service/products/agent/{{itemSourceSite}}/{{itemID}}.html',  eastmallbuy: 'https://www.eastmallbuy.com/index/item/...&inviter=repsadmin',  hubbuycn:    'https://www.hubbuycn.com/index/item/...&inviter=hubbuystats',  acbuy:       'https://www.acbuy.com/product?id={{itemID}}&source={{itemSourceSite}}&code=J285SD',};
Registration links rewritten to hardcoded referral URLs, observed and cited in the source
  • CSSBuy registration link
    https://cssbuy.com/register?invite=WmVyZW5kaXBwaXR5MTUyNg==

    Navigating to cssbuy.com/register redirects to this URL instead, crediting the developer's invite code.

  • AcBuy login/registration link
    https://acbuy.com/login?loginStatus=register&code=J285SD

    Navigating to acbuy.com/login redirects to this URL, which sets the registration flag and the developer's referral code.

  • CNFans registration link
    https://cnfans.com/register/?ref=185621

    Navigating to cnfans.com/register redirects to this URL, carrying the developer's referral code.

  • MuleBuy registration link
    https://mulebuy.com/register/?ref=200006142

    Navigating to mulebuy.com/register redirects to this URL, carrying the developer's referral code.

  • Product-page conversions (17 sites)
    https://www.pandabuy.com/product?ra=323&url=...&inviteCode=FashionReps

    Converting any supported product link appends that site's hardcoded referral or invite parameter, not one you supplied.

Destination sites that receive navigations carrying a hardcoded referral parameter
    • cssbuy.com

    Registration and product-conversion destination; receives invite= on registration and promotionCode=677e36ace374be6b on product conversions.

    • acbuy.com

    Registration/login destination; receives code=J285SD.

    • cnfans.com

    Registration and product-conversion destination; receives ref=185621.

    • mulebuy.com

    Registration and product-conversion destination; receives ref=200006142.

    • pandabuy.com

    Product-conversion destination; receives ra=323 and inviteCode=FashionReps.

    • hoobuy.com

    Product-conversion destination; receives inviteCode=5EAx3zDX.

    • allchinabuy.com

    Product-conversion destination; receives partnercode=wrOgUB.

    • hubbuycn.com

    Product-conversion destination; receives inviter=hubbuystats.

Check if you're affected

Scans an unpacked extension's background service worker file for hardcoded affiliate/referral parameters (ref=, code=, inviteCode=, promotionCode=, partnercode=, affcode=, inviter=) that get applied to navigations without a consent prompt.

Requires
  • Node.js 18+
referral-code-detector.js · js
// referral-code-detector.js// Scans a Chrome extension's background service worker source for// hardcoded affiliate/referral parameters.const fs = require('fs');const REFERRAL_PATTERNS = [  /ref=([\w-]+)/g,  /code=([\w-]+)/g,  /inviteCode=([\w-]+)/g,  /invite_code=([\w-]+)/g,  /promotionCode=([\w-]+)/g,  /partnercode=([\w-]+)/g,  /affcode=([\w-]+)/g,  /inviter=([\w=%-]+)/g,];const file = process.argv[2];if (!file) {  console.error('Usage: node referral-code-detector.js <path-to-background.js>');  process.exit(1);}const src = fs.readFileSync(file, 'utf8');const found = new Set();for (const pattern of REFERRAL_PATTERNS) {  let m;  while ((m = pattern.exec(src)) !== null) {    found.add(m[0]);  }}if (found.size === 0) {  console.log('No hardcoded referral parameters found.');} else {  console.log(`Found ${found.size} hardcoded referral/invite parameter(s):`);  for (const v of found) console.log(' -', v);}
How to run it
  1. 1Download the package from the Chrome Web Store and unpack it.
  2. 2Locate the service worker file.
  3. 3Run: node referral-code-detector.js <path>.
  4. 4Compare parameters against the site's referral program to see whose account is credited.

What it can do

Permissions this extension asks for, as declared in version 1.32. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on item.taobao.com

    https://*.item.taobao.com/*

  • Read and change your data on detail.tmall.com

    https://*.detail.tmall.com/*

  • Read and change your data on detail.1688.com

    https://*.detail.1688.com/*

  • Read and change your data on weidian.com

    https://*.weidian.com/*

  • Read and change your data on tb.cn

    *://*.tb.cn/*

  • Read and change your data on taobao.com

    *://*.taobao.com/*

  • Read and change your data on tmall.com

    *://*.tmall.com/*

  • Read and change your data on superbuy.com

    https://*.superbuy.com/*

  • Read and change your data on cnfans.com

    https://*.cnfans.com/*

  • Read and change your data on wegobuy.com

    https://*.wegobuy.com/*

  • Read and change your data on allchinabuy.com

    https://*.allchinabuy.com/*

  • Read and change your data on hoobuy.com

    https://hoobuy.com/*

  • Read and change your data on google.com

    https://*.google.com/* and 1 more

  • Read and change your data on pandabuy.com

    https://*.pandabuy.com/*

  • Read and change your data on mulebuy.com

    https://*.mulebuy.com/*

  • Read and change your data on joyagoo.com

    https://*.joyagoo.com/*

  • Read and change your data on sugargoo.com

    https://*.sugargoo.com/*

  • Read and change your data on cssbuy.com

    https://*.cssbuy.com/*

  • Read and change your data on basetao.com

    https://*.basetao.com/*

  • Read and change your data on lovegobuy.com

    https://*.lovegobuy.com/*

  • Read and change your data on hagobuy.com

    https://*.hagobuy.com/*

  • Read and change your data on kameymall.com

    https://*.kameymall.com/*

  • Read and change your data on eastmallbuy.com

    https://*.eastmallbuy.com/*

  • Read and change your data on hubbuycn.com

    https://*.hubbuycn.com/*

  • Read and change your data on oopbuy.com

    https://*.oopbuy.com/*

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Watch every request your browser makes

    webRequest

Where it sends data

Destinations our analysis observed FashionReps Link Converter contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • cnfans.com

    FashionReps Link Converter sends data to cnfans.com. 7 other extensions we have analysed send data here.

  • mulebuy.com

    FashionReps Link Converter sends data to mulebuy.com. 5 other extensions we have analysed send data here.

  • hoobuy.com

    FashionReps Link Converter sends data to hoobuy.com. 4 other extensions we have analysed send data here.

  • joyagoo.com

    FashionReps Link Converter sends data to joyagoo.com. 2 other extensions we have analysed send data here.

  • oopbuy.com

    FashionReps Link Converter sends data to oopbuy.com. One other extension we have analysed sends data here.

  • www.acbuy.com

    FashionReps Link Converter sends data to www.acbuy.com. One other extension we have analysed sends data here.

  • www.allchinabuy.com

    FashionReps Link Converter sends data to www.allchinabuy.com. One other extension we have analysed sends data here.

  • www.superbuy.com

    FashionReps Link Converter sends data to www.superbuy.com. One other extension we have analysed sends data here.

  • cssbuy.com

    FashionReps Link Converter sends data to cssbuy.com. No other extension we have analysed sends data here.

  • orientdig.com

    FashionReps Link Converter sends data to orientdig.com. No other extension we have analysed sends data here.

  • www.hagobuy.com

    FashionReps Link Converter sends data to www.hagobuy.com. No other extension we have analysed sends data here.

  • www.kameymall.com

    FashionReps Link Converter sends data to www.kameymall.com. No other extension we have analysed sends data here.

  • www.lovegobuy.com

    FashionReps Link Converter sends data to www.lovegobuy.com. No other extension we have analysed sends data here.

  • www.pandabuy.com

    FashionReps Link Converter sends data to www.pandabuy.com. No other extension we have analysed sends data here.

Updated 30 September 2026checcabgeleckmkmaebnojaaodmlhhnf