Is Flow for Chrome™ safe?

// On every Google search page, build and fire a tracking request to uru56.com.// 'aid' is hardcoded to '3100' at the top of content.js.this.sessionToken = generateShuffledTimestamp(); // random per-page tokenthis.searchQuery = getQueryParam('q'); // raw Google search termif (this.searchQuery.length > 2) { chrome.storage.local.get({ we: 'org' }, (stored) => { const params = new URLSearchParams({ format: 'json', nohtml: '1', tr: this.sessionToken, a: '3100', // hardcoded affiliate ID e: chrome.runtime.id, // extension's stable CRX ID u: manifest.version.replace(/\./g, '-'), // e.g. '1-0-3' keyword: this.searchQuery, // the user's search term by: manifest.name, // 'Flow for Chrome™' crt: stored.we, // stored org tag, default 'org' }); this.fetchResults('https://uru56.com/script/t.php?' + params); });}

// withCredentials=true means any uru56.com cookies are included in the request.fetchResults(url) { const xhr = new XMLHttpRequest(); xhr.withCredentials = true; // sends uru56.com cookies alongside the request xhr.onreadystatechange = () => { if (xhr.readyState === 4 && xhr.responseText.length > 0) { const json = JSON.parse(xhr.responseText); displayResults(json.data); // renders ads + may inject CSS + fires Yahoo beacon } }; xhr.open('GET', url, true); xhr.send();}

// Fires after uru56.com returns SearchID and SourceTag in its JSON response.const ysid = data.SearchID; // session ID from uru56.comconst source = data.SourceTag; // attribution tag from uru56.comif (ysid && source) { const inFrame = window.frames.length !== parent.frames.length; const referrer = document.referrer ? encodeURIComponent(document.referrer) : ''; const pageUrl = encodeURIComponent(window.location.href); // full Google search URL // Two endpoints, differing only in c_int2 const endpoints = { 'search.yahoo.com': { c_int2: 2 }, 'xmlp.search.yahoo.com': { c_int2: 1 }, }; const baseParams = { s: '1197808038', // hardcoded Yahoo publisher/site ID c_int1: inFrame ? 1 : 0, c_str1: referrer, // URL-encoded referrer c_str2: pageUrl, // URL-encoded current Google search URL ysid: ysid, // session ID from uru56.com response traffic_source: source, // e.g. 'flowsurf_enhan_xmlb_1790_flow' }; for (const host of Object.keys(endpoints)) { const params = { ...baseParams, ...endpoints[host] }; const url = 'https://' + host + '/beacon/geop/p?' + new URLSearchParams(params); const img = document.createElement('img'); img.height = '1'; img.width = '1'; img.src = url; // fires the tracking pixel document.body.appendChild(img); }}