Is JoyaGoo Warm Reminder Remover safe?

Medium risk

JoyaGoo Warm Reminder Remover rewrites supported shopping product URLs with hardcoded affiliate referral codes.

When you visit product pages on CNFans, MuleBuy, HooBuy, or JoyaGoo, the content script checks the current URL and replaces its ref parameter with a hardcoded referral value. The page is then reloaded with that modified URL, so the shopping site receives the affiliate referral code as part of the product-page address.

45Risk
Who publishes it

1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Same store account

1 other listing published from this account, 1k+ users between them, none of them carrying a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension Overwrites Any Existing Affiliate Code With Its Own

On cnfans.com, mulebuy.com, hoobuy.com, or joyagoo.com pages, the script checks the URL's ref parameter against its hardcoded code, overwriting and auto-reloading if it differs or is missing.

The popup remover runs only once ref matches.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a product page on cnfans.com, mulebuy.com, hoobuy.com, or joyagoo.com.

Works on any /product URL on these four sites, whether the URL has no ref parameter or already carries a different one.

The extension did this

The content script rewrites the page URL's ref parameter to its own hardcoded code and reloads the tab.

content.js's updateRefInURL() calls searchParams.set('ref', referralCode) and window.location.replace() whenever the current ref value does not already equal that code.

Hardcoded referral code injected per site
  • cnfans.com referral code
    ref=155562

    Every cnfans.com product URL you open gets this fixed code in its ref parameter.

  • mulebuy.com referral code
    ref=200151616

    Every mulebuy.com product URL you open gets this fixed code in its ref parameter.

  • joyagoo.com referral code
    ref=300000171

    Every joyagoo.com product URL you open gets this fixed code in its ref parameter.

  • hoobuy.com referral code
    ref=utm_source=share&utm_medium=product_details&inviteCode=zXvrg2Xw

    hoobuy.com's code packs a full query string into the single ref parameter.

The code that does this

The shipped content script -- unminified as distributed in the Chrome Web Store package.

Readable version

The hardcoded referral codes

content.js
function getReferralCode() {    const hostname = window.location.hostname;    if (hostname === "cnfans.com") return "155562";    if (hostname === "mulebuy.com") return "200151616";    if (hostname === "joyagoo.com") return "300000171";    if (hostname === "hoobuy.com") return "utm_source=share&utm_medium=product_details&inviteCode=zXvrg2Xw";    return "";  }

The URL rewrite, gated on the ref value not already matching

content.js
function updateRefInURL() {    const currentURL = new URL(window.location.href);    const hostname = currentURL.hostname;    const referralCode = getReferralCode();    // Check if we are on a product page and if the ref code needs to be added or updated    const isProductPage = currentURL.pathname.includes("/product");    const currentRef = currentURL.searchParams.get("ref");    if (      (hostname === "cnfans.com" || hostname === "mulebuy.com" || hostname === "hoobuy.com" || hostname === "joyagoo.com") &&      isProductPage && currentRef !== referralCode    ) {      currentURL.searchParams.set("ref", referralCode);      window.location.replace(currentURL.toString());    }  }

The advertised popup-removal feature, gated on the same match

content.js
function handleModalRemoval() {    const hostname = window.location.hostname;    const currentRef = new URL(window.location.href).searchParams.get("ref");    const referralCode = getReferralCode();    // Handle modals for cnfans.com and mulebuy.com    if (hostname === "cnfans.com" || hostname === "mulebuy.com") {      if (currentRef === referralCode) {        const modal = document.getElementById("keywords-modal");        if (modal) {          modal.style.display = "none";          modal.remove();          restoreScrolling();          showCenteredNotification("Window Removed by JoyaGoo Warn Remover! Please leave a review!");        }      }    } else if (hostname === "hoobuy.com" && currentRef === referralCode) {      waitForElement(".el-overlay", modal => {        modal.style.display = "none";        modal.remove();        restoreScrolling();        showCenteredNotification("Window Removed by JoyaGoo Warn Remover! Please leave a review!");      });    } else if (hostname === "joyagoo.com" && currentRef === referralCode) {      // Look for the new JoyaGoo modal      const checkForModal = setInterval(() => {        // Try to find the new modal wrapper        const modalWrapper = document.querySelector(".n-modal-body-wrapper");        if (modalWrapper) {          // First, capture the body's scroll position          const scrollY = window.scrollY;          // Find the parent elements that contain or are related to the modal          const modalContainer = modalWrapper.closest(".n-modal-container");          const modalBody = document.querySelector(".n-modal-body");          const modalWrapper2 = document.querySelector(".n-modal-wrapper");          // Remove all modal-related elements          if (modalContainer) modalContainer.remove();          if (modalBody) modalBody.remove();          if (modalWrapper2) modalWrapper2.remove();          modalWrapper.remove();          // Remove any backdrop/mask that might be present          const modalMasks = document.querySelectorAll(".n-modal-mask");          modalMasks.forEach(mask => mask.remove());          // Remove any overlay that might be present          const overlays = document.querySelectorAll(".n-modal-overlay");          overlays.forEach(overlay => overlay.remove());          // Restore scrolling          restoreScrolling();          // Restore scroll position          window.scrollTo(0, scrollY);          // Show notification          showCenteredNotification("Window Removed by JoyaGoo Warn Remover! Please leave a review!");          // Clear the interval as we've found and removed the modal          clearInterval(checkForModal);        }      }, 200);      // Stop checking after 10 seconds      setTimeout(() => clearInterval(checkForModal), 10000);    }  }
Merchant sites the rewritten URL is sent to on navigation
    • cnfans.com

    Receives the extension's hardcoded code (155562) as the ref parameter on every visited /product page.

    • mulebuy.com

    Receives the extension's hardcoded code (200151616) as the ref parameter on every visited /product page.

    • hoobuy.com

    Receives the extension's hardcoded utm_source/utm_medium/inviteCode string as the ref parameter on every visited /product page.

    • joyagoo.com

    Receives the extension's hardcoded code (300000171) as the ref parameter on every visited /product page.

Reproduce it yourself

Watches the address bar for the automatic ref-parameter rewrite so you can see the code fire without needing to read the extension's source.

Requires
  • Chrome DevTools
joyagoo-ref-rewrite-check.js · js
// joyagoo-ref-rewrite-check.js// Detects the automatic ref-parameter rewrite performed by JoyaGoo Warm// Reminder Remover's content script on supported product pages.(function () {  const before = location.href;  console.log('[joyagoo-check] initial URL:', before);  const start = Date.now();  const poll = setInterval(() => {    if (location.href !== before) {      console.log('[joyagoo-check] URL changed after', Date.now() - start, 'ms');      console.log('[joyagoo-check] before:', before);      console.log('[joyagoo-check] after: ', location.href);      clearInterval(poll);    }    if (Date.now() - start > 8000) {      console.log('[joyagoo-check] no change observed within 8s');      clearInterval(poll);    }  }, 100);})();
How to run it
  1. 1Install the extension.
  2. 2Open a /product URL on cnfans.com, mulebuy.com, hoobuy.com, or joyagoo.com with no ref param, or a different one.
  3. 3Open DevTools, paste this script.
  4. 4Watch the URL change within ~200ms.

What it can do

Permissions this extension asks for, as declared in version 1.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on cnfans.com

    https://*.cnfans.com/*

  • Read and change your data on mulebuy.com

    https://*.mulebuy.com/*

  • Read and change your data on hoobuy.com

    https://*.hoobuy.com/*

  • Read and change your data on joyagoo.com

    https://*.joyagoo.com/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed JoyaGoo Warm Reminder Remover contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • cnfans.com

    JoyaGoo Warm Reminder Remover sends data to cnfans.com. 7 other extensions we have analysed send data here.

  • mulebuy.com

    JoyaGoo Warm Reminder Remover sends data to mulebuy.com. 5 other extensions we have analysed send data here.

  • hoobuy.com

    JoyaGoo Warm Reminder Remover sends data to hoobuy.com. 4 other extensions we have analysed send data here.

  • joyagoo.com

    JoyaGoo Warm Reminder Remover sends data to joyagoo.com. 2 other extensions we have analysed send data here.

Updated 30 September 2026eabidodonpjcpcjfmmjfjkdcdjcpddgj