Is Shopilo: Automatic Coupon Finder by DontPayFull safe?

// Fires on every tab update; only proceeds once the page has
// finished loading AND the URL passes an internal store-recognition check.
chrome.tabs.onUpdated.addListener(async (tabId, { status }, tab) => {
  if (tab.url && await isRecognizedSite(tab.url) && status === "complete") {
    await reportPageView(tabId, tab.url);
  }
});

// Handles the TRACK_PAGE message the background worker just sent.
// eventsPageViewTrack is a value pulled from DontPayFull's remote config
// (loaded via GLOBAL_CONFIG) -- it can be "supported", "all", or unset.
onMessage(Messages.EXTENSION.TRACK_PAGE, () => {
  if (isExtensionLoading.value) return;
  // "supported": only send if THIS site is on DontPayFull's own store list
  if (eventsPageViewTrack.value === "supported" && isStoreSupported.value) {
    track(Events.PAGE_VIEW);
  }
  // "all": send for every site, no store-list check
  if (eventsPageViewTrack.value === "all") {
    track(Events.PAGE_VIEW);
  }
  return true;
});

// Turns the active tab's URL into just its hostname, then attaches
// the extension's own ID, version, and a session-correlation hash.
async function createEventObject(eventName, storeId = "", opts = {}) {
  const tabInfo = opts.tabId ? await getTabInfoById(opts.tabId) : null;
  let hostname = "";
  if (tabInfo && tabInfo.url) {
    hostname = new URL(tabInfo.url).hostname.replace("www.", "");   // <-- the page you visited, reduced to its domain
  }
  const defaults = await getDefaultObject(eventName, storeId, opts.tabId, hostname);
  const extra = getExtraData(eventName, opts);
  return { ...defaults, extra };
}

async function getDefaultObject(eventName, storeId, tabId, hostname) {
  const clientId = chrome.runtime.id;   // constant extension ID, same for every install
  return {
    client_id: clientId,
    sid: storeId,
    version: chrome.runtime.getManifest().version,
    session_group: hashOf(`${clientId}--${storeId}-${tabId ?? 0}`),
    release_type: getReleaseType(),
    event: eventName,
    url: hostname,          // <-- the visited hostname, in the clear
  };
}

// Reads your DontPayFull account ID out of the auth cookie's JWT payload
// and stamps it onto the event object about to be sent.
async function attachUserIdToLog(eventObject) {
  let userId = await getUserIdFromAuthCookie();
  const cachedId = await getCachedUserId();
  if (!userId && cachedId && cachedId !== "undefined") {
    userId = cachedId;
    await refreshCachedUserId();
  }
  if (userId) {
    eventObject.extra.uid = userId;   // <-- ties this page view to your account
  }
}

// Copies the event object, drops any empty fields, stamps a fingerprint
// timestamp, then encodes it into a header using base64 + a randomized
// letter-shift cipher. This is obfuscation, not encryption -- there is no
// key and no server-side lookup. The shift amount and stripped-padding
// count are appended in the clear as the header's last two characters, so
// anyone holding the header value can reverse it (see the artifact block).
async function addSessionHeader(headers, eventOpts) {
  const eventCopy = await createEventObject(eventOpts);
  Object.keys(eventCopy).forEach((key) => {
    if (!eventCopy[key] || key === "extra") delete eventCopy[key];
  });
  eventCopy.fingerprint = Date.now() / 1000;
  headers["X-Session"] = obfuscate(JSON.stringify(eventCopy));
}

function obfuscate(jsonText) {
  let base64 = btoa(encodeURIComponent(jsonText));
  let paddingRemoved = 0;
  if (base64.endsWith("==")) { base64 = base64.slice(0, -2); paddingRemoved = 2; }
  else if (base64.endsWith("=")) { base64 = base64.slice(0, -1); paddingRemoved = 1; }

  const shift = 3 + Math.floor(Math.random() * 6);         // random shift, 3-8
  const padded = randomChars(4) + base64 + randomChars(4); // random padding, both ends
  return caesarShift(padded, shift) + paddingRemoved + shift;
}

AUTH_COOKIE: {
  url: "https://www.dontpayfull.com/",
  name: "AUTH_BEARER_DPF"
}

function h(g) {
  var _;
  if (!g) return !1;
  const p = t(g.value);
  return !(!p || !p.data || !((_ = e(p.data)) != null && _.id))
}
async function f() {
  try {
    return await C.cookies.get(Z.AUTH_COOKIE)
  } catch (g) {
    return ze.error("getAuthCookie", g), g.message && g.message.includes(Kr.NO_HOST_PERMISSIONS_COOKIE) && await i(P.EXTENSION.SET_PERMISSIONS_REMOVED_SCREEN, {
      visibility: !0
    }), null
  }
}
async function A() {
  var p;
  const g = await f();
  if (g != null && g.value) {
    const _ = t(g == null ? void 0 : g.value);
    return (p = e(_.data)) == null ? void 0 : p.id
  }
}
async function T(g) {
  let p = await A();
  const _ = await r();
  !p && _ && _ !== "undefined" && (p = _, await o()), p && (g.extra.uid = p)
}
return {
  openAuthWindow: c,
  closeAuthWindow: d,
  handleRemovedAuthWindow: l,
  logOut: u,
  extractAuthInfoFromCookie: h,
  attachUserIdToLog: T,
  getAuthCookie: f
}

class Li {
  constructor(e) {
    this.codeApplyInfo = {}, this.code = "", this.error = "", this.index = -1, this.maxIndex = -1, this.sid = -1, this.extensionID = "", this.stoppedBy = X.NO_STOPPED, this.version = "0.0.0", this.releaseType = "public", this.tabID = -1, this.codeApplyInfo = e.storage.currentCodeApplyInfo, this.code = e.storage.currentCode, this.index = e.storage.currentIndex, this.error = e.storage.lastError, this.maxIndex = e.storage.maxIndex, this.sid = e.storage.sid, this.extensionID = e.extensionID, this.stoppedBy = e.storage.stoppedBy, this.version = e.extVersion, this.releaseType = e.releaseType, this.tabID = e.tabID
  }
  getLog() {
    var o, i, a;
    var e, n, s;
    const r = `${this.extensionID}--${this.sid}-${this.tabID}`;
    return {
      client: {
        id: this.extensionID || ""
      },
      tid: Array.isArray(this.codeApplyInfo.trainings) && this.codeApplyInfo.trainings[0].id ? this.codeApplyInfo.trainings[0].id : -1,
      tv: this.codeApplyInfo.trainingVersion || "",
      session: this.codeApplyInfo.session || "",
      index: this.index > -1 ? this.index : -1,
      index_max: (o = this.maxIndex) != null ? o : -1,
      sid: (i = this.sid) != null ? i : -1,
      code: (a = (e = this.codeApplyInfo.codeInfo) == null ? void 0 : e.hash) != null ? a : this.code || "",
      code_type: (n = this.codeApplyInfo.codeInfo) == null ? void 0 : n.type,
      is_code_hash: !!((s = this.codeApplyInfo.codeInfo) != null && s.hash),
      steps: this.codeApplyInfo.steps || {},
      started_at: this.codeApplyInfo.startedAt || new Date("01/01/1970").toISOString(),
      ended_at: this.codeApplyInfo.endedAt || new Date("01/01/1970").toISOString(),
      last_error: this.error || "",
      session_stopped_by: this.stoppedBy || "",
      version: this.version || it.EXT_VERSION,
      session_group: ee.hashStr(r),
      release_type: this.releaseType || it.RELEASE_TYPE
    }
  }
  sendLog() {
    if (Di() || !this.codeApplyInfo.startedAt && !this.codeApplyInfo.endedAt) return Promise.resolve();
    const e = this.getLog();
    return fetch("https://events.dpf.cloud/automatic-coupons/cycles", {
      method: "POST",
      headers: {
        "Content-Type": "application/json"
      },
      body: JSON.stringify(e)
    })
  }
}

async function t(o) {
  return await xm().attachUserIdToLog(o), Xc(ws.EVENTS_LOG).request({
    method: "post",
    postData: o
  })
}

function n({
  url: o,
  body: r
}) {
  return Xc(o).request({
    method: "post",
    postData: r
  })
}
return {
  sendCouponReview: e,
  sendEventLog: t,
  sendGA4Log: n
}

if (!D.length) {
  t(ve.START_AUTOAPPLY), n(vn.APPLY_COUPONS, {
    location: !0
  });
  const T = await Q();
  if (T && T.preventLoad) return Kt().setMainScreenVisibility(!0)
}
r(), D.length ? (x ? c(D, f.value) : A(D), v.value = !1) : s(), l(!0), _i().applyHopURL(), Bo().removeStandDownOnInteract(), mo().closeAutoApplyPopup(), p(!1), await fr().startApplyingSession()