Is iGive Button safe?
iGive Button sends visited site URLs and merchant-page activity to PostHog when its tracking rules match.
The extension checks top-frame navigations against tracking settings refreshed from iGive, and can record the current URL with a timestamp before sending a Tracked Site event. On matching merchant, cart, checkout, and purchase pages, its all-sites content script reports the page URL, referrer, merchant metadata, cashback details, and page type to PostHog.
Who publishes itiGive Holdings, LLC - no other listings under this identity, 6 shared hostnames
iGive Holdings, LLC - no other listings under this identity, 6 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 6 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
iGive Button reports the merchant pages you visit to PostHog
iGive Button sends the URL and referrer of store pages to PostHog. staples.com and crocs.com fire 'Merchant Visit'; carts fire 'Checkout Visit', confirmation pages fire 'Purchase Completed'.
Events carry your iGive ID when logged in.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to a store the extension recognizes as an iGive cashback partner, such as staples.com.
The content script is injected on every page (*://*/*) and asks the background script whether the current domain matches iGive's merchant list.
The extension sends the page's full URL, referrer, and merchant details to PostHog as a 'Merchant Visit' event.
If the URL path looks like a cart, checkout, or order-confirmation page, a second 'Checkout Visit' or 'Purchase Completed' event is sent in the same batch.
HTTP 200. PostHog's event-ingestion endpoint acknowledges receipt with no distinguishing response body.
[ { "event": "Merchant Visit", "properties": { "merchant_id": "9922", "merchant_name": "Staples.com", "url": "https://www.staples.com/cart", "cashback": "1.6", "page_type": "checkout" } }, { "event": "Checkout Visit", "properties": { "merchant_id": "9922", "merchant_name": "Staples.com", "url": "https://www.staples.com/cart", "cashback": "1.6" } }]- Page URLhttps://www.staples.com/cart
The exact web address of the page you're on, including the specific path (e.g. which product or which cart).
- Referrerdirect
The page that sent you to the merchant site, which can reveal what you searched for or which link you clicked.
- Merchant ID and name9922 / Staples.com
Which store's cashback program you're browsing, matched against iGive's own merchant catalog.
- Page typecheckout
Whether the page is a store page, a cart, or a completed order; this shows your place in the purchase funnel, not just that you visited.
- iGive member IDMID-482193
A persistent account ID the extension attaches to your PostHog profile when logged in, linking every merchant visit back to your account.
Merchant-visit tracking, src/entries/contentScript/main-D_yq2G7I.js:1280-1314
async initSlider() { const merchant = this.merchant; if (merchant && triggerValidation(window.location.href, merchant)) { const currentUrl = window.location.href; const pageType = this.detectPageType(currentUrl); // Fires on EVERY page load that matches a known merchant domain. this.posthogService?.capture('Merchant Visit', { merchant_id: merchant.mId, merchant_name: merchant.name, merchant: merchant, // full merchant record: id, domain, name, cashback rate url: currentUrl, // the exact page you're on referrer: document.referrer || 'direct', cashback: merchant.cashback, page_type: pageType || 'merchant_page' }, PostHogContext.ContentScript); // Additionally fires when the URL path matches /cart, /checkout, /basket, etc. if (pageType === 'checkout') { this.posthogService?.capture('Checkout Visit', { merchant_id: merchant.mId, merchant_name: merchant.name, merchant: merchant, url: currentUrl, cashback: merchant.cashback }, PostHogContext.ContentScript); } // Additionally fires when the URL path matches /order-confirmation, /thank-you, /receipt, etc. if (pageType === 'purchase') { this.posthogService?.capture('Purchase Completed', { merchant_id: merchant.mId, merchant_name: merchant.name, merchant: merchant, url: currentUrl, cashback: merchant.cashback }, PostHogContext.ContentScript); } // Renders the cashback popup UI on the page (unrelated to the tracking above). await renderContent(["assets/main-wTlxtulB.css"], async (appRoot) => { const app = createApp(App, { merchant, merchantState: this.merchantsState.getState(merchant.mId) }); SentryIO.initVueIntegration(app, undefined, SentryContext.ContentScript); window.addEventListener('beforeunload', () => { SentryIO.disposeContext(SentryContext.ContentScript); }); if (this.posthogService) { const posthogPlugin = createPostHogPlugin(this.posthogService); app.use(posthogPlugin); } app.mount(appRoot); }, document.documentElement, InsertMethod.Prepend); }}- us.posthog.com
PostHog Inc., third-party analytics; API host for the PostHog client. Receives Merchant Visit, Checkout Visit, and Purchase Completed events with page URL, referrer, merchant data.
- us.i.posthog.com
PostHog's event-ingestion subdomain. This is the endpoint the client library actually POSTs captured events to (observed during dynamic analysis as /e/).
What it can do
Permissions this extension asks for, as declared in version 11.2.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
See the address and title of every tab you have open
tabs
Watch every request your browser makes
webRequest
See every page you navigate to, as you navigate to it
webNavigation
Store data in your browser
storage
Read and change cookies, including the ones that keep you signed in
cookies
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed iGive Button contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- us.posthog.com
iGive Button sends data to us.posthog.com. 5 other extensions we have analysed send data here.