Is Funpay extension safe?
Funpay extension is medium risk. Each time you open the extension's settings page on funpay.com, it sends the entire page's HTML plus its own locally stored login token to fpextension.biz, then replaces what you see with the server's reply.
Who publishes itLotti - no other listings under this identity, 1 shared hostname
Lotti - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Funpay extension sends the full settings page and login token to its own server
Each time you open the extension's settings page on funpay.com, it sends the entire page's HTML plus its own locally stored login token to fpextension.biz, then replaces what you see with the server's reply.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open the extension's settings page at funpay.com/extension.
This is the extension's own in-page dashboard, not a general Funpay page.
The content script automatically sends the whole page's HTML and your local extension token to fpextension.biz.
The reply it gets back is used to fill in the page content you then see.
- Page HTML<div class="wrapper-content">...<span class="user-link-name">Player_92</span>...</div>
The full visible content of the settings page, including your Funpay display name shown there, is copied and sent.
- Extension login tokene3a9f1c2-8b7d-4f0a-9c1e-2d5b6a7f8e9d
The token that authenticates you to the extension's own subscription service, read straight from browser storage.
HTML fragment returned and used to replace the settings page content
- Content-Type
- application/x-www-form-urlencoded
body=<HTML of the settings page>&token=<redacted>content/main/index.js: the upload runs as soon as the settings page renders
Server domain, loaded on every funpay.com page
content/scripts/funpay.jsconst REMOTE_SERVER = "https://fpextension.biz"; // the extension vendor's own backend, not funpay.comWaits for the settings page, then uploads it
content/main/index.js// Watch the page until the extension settings container appearsconst watchForSettingsPage = new MutationObserver(async () => { if (!$(".cd.cd-empty.mb50")[0]) { return } // settings container not rendered yet, keep waiting watchForSettingsPage.disconnect(); // only run this once per page load const funpayDisplayName = $(".user-link-name").eq(0).text(); // Clear the page and show a loading placeholder $(".theme-css").remove(); $(".wrapper-content").empty(); $(".wrapper-footer").remove(); $(".wrapper-content").append( `<div> <span class="loadSub">Loading</span> <span class="descriptionSub">Refreshing your account information</span> </div>` ); // Upload the ENTIRE current page HTML plus the locally stored extension // token to the vendor's own server, and wait for it to render the reply const response = await fetch(`${REMOTE_SERVER}/runner`, { method: "post", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ body: $("body").html(), // full page HTML token: localStorage.getItem("token") // extension's own login token }) });Starts watching the page for the settings container
content/main/index.js// Start watching document.body for the settings container to appearwatchForSettingsPage.observe(document, { childList: true, subtree: true});- fpextension.biz
The extension's own backend service, separate from funpay.com. Receives the settings page HTML and your local extension token on every visit.
What it can do
Permissions this extension asks for, as declared in version 1.31. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on fpextension.biz
https://fpextension.biz/*
Read and change your data on funpay.com
https://funpay.com/*
Store data in your browser
storage
Read and change cookies, including the ones that keep you signed in
cookies
Schedule its own background tasks
alarms