Is Funpay extension safe?

Medium risk

Funpay extension is medium risk. Each time you open the extension's settings page on funpay.com, it sends the entire page's HTML plus its own locally stored login token to fpextension.biz, then replaces what you see with the server's reply.

46Risk
Who publishes it

Lotti - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Lotti

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

support.funpay.com
Also called by 2 other listings: FunPay Tools, FunPay Lite Bot

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Funpay extension sends the full settings page and login token to its own server

Each time you open the extension's settings page on funpay.com, it sends the entire page's HTML plus its own locally stored login token to fpextension.biz, then replaces what you see with the server's reply.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open the extension's settings page at funpay.com/extension.

This is the extension's own in-page dashboard, not a general Funpay page.

The extension did this

The content script automatically sends the whole page's HTML and your local extension token to fpextension.biz.

The reply it gets back is used to fill in the page content you then see.

What's included in each automatic upload
  • Page HTML
    <div class="wrapper-content">...<span class="user-link-name">Player_92</span>...</div>

    The full visible content of the settings page, including your Funpay display name shown there, is copied and sent.

  • Extension login token
    e3a9f1c2-8b7d-4f0a-9c1e-2d5b6a7f8e9d

    The token that authenticates you to the extension's own subscription service, read straight from browser storage.

Captured request
POSThttps://fpextension.biz/runner

HTML fragment returned and used to replace the settings page content

Headers
Content-Type
application/x-www-form-urlencoded
Body
body=<HTML of the settings page>&token=<redacted>
The code that does this

content/main/index.js: the upload runs as soon as the settings page renders

Readable version

Server domain, loaded on every funpay.com page

content/scripts/funpay.js
const REMOTE_SERVER = "https://fpextension.biz"; // the extension vendor's own backend, not funpay.com

Waits for the settings page, then uploads it

content/main/index.js
// Watch the page until the extension settings container appearsconst watchForSettingsPage = new MutationObserver(async () => {    if (!$(".cd.cd-empty.mb50")[0]) { return } // settings container not rendered yet, keep waiting    watchForSettingsPage.disconnect(); // only run this once per page load    const funpayDisplayName = $(".user-link-name").eq(0).text();    // Clear the page and show a loading placeholder    $(".theme-css").remove();    $(".wrapper-content").empty();    $(".wrapper-footer").remove();    $(".wrapper-content").append(        `<div>            <span class="loadSub">Loading</span>            <span class="descriptionSub">Refreshing your account information</span>        </div>`    );    // Upload the ENTIRE current page HTML plus the locally stored extension    // token to the vendor's own server, and wait for it to render the reply    const response = await fetch(`${REMOTE_SERVER}/runner`, {        method: "post",        headers: { "Content-Type": "application/x-www-form-urlencoded" },        body: new URLSearchParams({            body: $("body").html(),               // full page HTML            token: localStorage.getItem("token")   // extension's own login token        })    });

Starts watching the page for the settings container

content/main/index.js
// Start watching document.body for the settings container to appearwatchForSettingsPage.observe(document, {    childList: true,    subtree: true});
Where the upload goes
    • fpextension.biz

    The extension's own backend service, separate from funpay.com. Receives the settings page HTML and your local extension token on every visit.

What it can do

Permissions this extension asks for, as declared in version 1.31. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on fpextension.biz

    https://fpextension.biz/*

  • Read and change your data on funpay.com

    https://funpay.com/*

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Schedule its own background tasks

    alarms

Updated 30 September 2026ecccjfpmhpnahbldabbhdccohmnidmkc