Is Kakobuy+ safe?

Medium risk

Kakobuy+ rewrites Kakobuy page URLs to include the hardcoded stannie affiliate code.

When pages on kakobuy.com load, Kakobuy+ adds or replaces the affcode URL parameter with stannie, including inside hash-based URLs. On item detail pages, it also removes or clicks through Kakobuy warning and risk modals when auto-remove is enabled by default.

Stanniev3.0Chrome Web Store
45Risk
Who publishes it

Stannie - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Stannie
Website
discord.gg/stannie

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Content Script Overwrites Kakobuy Affiliate Code With Hardcoded Value

On kakobuy.com, Kakobuy+ checks the URL for an affcode parameter.

If missing or not its hardcoded code, it reloads the page with affcode=stannie substituted in.

Runs on every load and on in-page navigation, overriding other affiliate codes.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a kakobuy.com page, with no affcode parameter, or one belonging to a different affiliate.

No click or extension interaction is required; this covers ordinary navigation to the site.

The extension did this

Kakobuy+ reloads the page with affcode=stannie, its own hardcoded affiliate code, set in the URL, replacing whatever affcode value was there before.

The rewrite runs on the extension's own initialization, independent of the 'Auto remover' toggle in the popup.

Reproduced on two different starting URLs; both end at affcode=stannie.

  1. on page load

    You did

    Open https://www.kakobuy.com/, no affcode parameter present.

    The extension did

    Page reloads at https://www.kakobuy.com/?affcode=stannie.

  2. ~65ms after page load

    You did

    Open https://www.kakobuy.com/?affcode=someoneelse, a link carrying a different affiliate's code.

    The extension did

    Page reloads at https://www.kakobuy.com/?affcode=stannie, replacing the original affcode value.

The code that does this

content.js is shipped unminified; shown here with the mechanism annotated line by line.

Readable version

Same code, annotated (content.js ships unminified — no renaming needed)

// Hardcoded affiliate identifier the extension always wants present.const KAKOBUY_REFERRAL = { key: "affcode", value: "stannie" };// Only activates on kakobuy.com.function getReferralCode() {    const hostname = window.location.hostname.replace(/^www\./, "");    return hostname === "kakobuy.com" ? KAKOBUY_REFERRAL : null;}// Compares the current URL's affcode against the hardcoded value.// Any mismatch (absent, or a different affiliate's code) triggers a// full-page navigation that rewrites the URL to affcode=stannie.function enforceReferral() {    const partnercode = getReferralCode();    if (!partnercode) return false;    const url = new URL(window.location.href);    // Handles hash-routed URLs (query string inside the #fragment).    if (url.hash) {        const questionMarkPos = url.hash.indexOf("?");        if (questionMarkPos === -1) {            window.location.href = url.origin + url.pathname + url.hash + "?affcode=stannie";            return true;        } else {            const hash = url.hash.substring(0, questionMarkPos);            const searchParams = new URLSearchParams(url.hash.substring(questionMarkPos + 1));            if (searchParams.get("affcode") !== "stannie") {                searchParams.set("affcode", "stannie");                window.location.href = url.origin + url.pathname + hash + "?" + searchParams.toString();                return true;            }        }        return false;    }    // Ordinary query-string URLs: overwrite affcode and reload.    if (url.searchParams.get("affcode") !== "stannie") {        url.searchParams.set("affcode", "stannie");        window.location.href = url.toString();        return true;    }    return false;}
Captured request
GEThttps://www.kakobuy.com/?affcode=stannie

Top-level navigation request produced by the content script's window.location.href reassignment. No request body is involved, the affiliate code travels in the URL query string itself. Observed during dynamic analysis, reproduced from both a bare kakobuy.com URL and one carrying a different affcode value.

Reproduce it yourself

Logs the page's affcode query parameter every time the URL changes, so you can watch Kakobuy+ rewrite it in real time.

Requires
  • Chrome with Kakobuy+ installed
  • DevTools console
kakobuy-affcode-watch.js · js
// kakobuy-affcode-watch.js// Paste into the DevTools console on a kakobuy.com tab to watch the// affcode query parameter as the page loads and navigates.(function () {  let lastHref = location.href;  function logAffcode(label) {    const url = new URL(location.href);    const affcode = url.searchParams.get('affcode');    console.log('[AFFCODE_WATCH] ' + label + ': affcode=' + (affcode ?? '(none)') + ' -- ' + location.href);  }  logAffcode('initial');  setInterval(() => {    if (location.href !== lastHref) {      lastHref = location.href;      logAffcode('url changed');    }  }, 100);  console.log('[AFFCODE_WATCH] installed -- navigate to a kakobuy.com URL with no affcode, or a different affcode, to see it get overwritten.');})();
How to run it
  1. 1Open https://www.kakobuy.com/?affcode=someoneelse (or any kakobuy.com URL with no affcode).
  2. 2Open DevTools, paste this script right after the page starts loading.
  3. 3Watch '[AFFCODE_WATCH]' logs; affcode becomes 'stannie' when active.

Where it sends data

Destinations our analysis observed Kakobuy+ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • kakobuy.com

    Kakobuy+ sends data to kakobuy.com. One other extension we have analysed sends data here.

Updated 30 September 2026cahoolpfkffblagnfbbngjeiklpfbnof