Is Karma | Online shopping, but better safe?
Karma is low risk. Visiting Honey's welcome or uninstall page makes Karma's content script read the tab URL and report the event to its own server. Observed GETs to api-e.karmanow.com: event=honey_install from /welcome, event=honey_uninstall from /uninstall.
Who publishes itKarma - no other listings under this identity, 4 shared hostnames
Karma - no other listings under this identity, 4 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 4 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Karma Reports Honey Extension Installs and Uninstalls
Visiting Honey's welcome or uninstall page makes Karma's content script read the tab URL and report the event to its own server.
Observed GETs to api-e.karmanow.com: event=honey_install from /welcome, event=honey_uninstall from /uninstall.
- Severity
- Low unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You open Honey's post-install welcome page or its uninstall confirmation page in any tab.
This fires on any navigation to a joinhoney.com/welcome or joinhoney.com/uninstall URL; it does not require Karma's own UI to be open.
Karma's background service worker sends a GET request naming the specific Honey event to Karma's own analytics server.
The request goes to api-e.karmanow.com with event=honey_install or event=honey_uninstall, along with the page URL and a session tab ID.
Fire-and-forget analytics beacon; no response body is consumed by the extension.
Fire-and-forget analytics beacon; no response body is consumed by the extension.
Honey URL detector and event builder, inject.bundle.js
URL detector (content script, runs on every page load)
(function () { try { var pageUrl = window.location.href; var decodedUrl = decodeURIComponent(pageUrl); if (decodedUrl.includes("joinhoney.com/welcome")) { buildAloomaEvent(EVENT_NAMES.HONEY_INSTALL); } if (decodedUrl.includes("joinhoney.com/uninstall")) { buildAloomaEvent(EVENT_NAMES.HONEY_UNINSTALL); } } catch (e) { logger.warn(e); }})();buildAloomaEvent() — builds the event and relays it to the background worker
function buildAloomaEvent(eventName, extraData) { var payload = { name: eventName, data: Object.assign({}, extraData || {}, { current_url: window.location.href, browser_version: chromeMajorVersion, tab_id: getSessionTabId(), event_number: nextEventNumber() // persisted per-tab in sessionStorage }) }; chrome.runtime.sendMessage("trackAloomaEvent", payload);}- Page URL you visitedhttps://www.joinhoney.com/welcome
The full URL of the Honey page that triggered detection, revealing exactly when you installed or uninstalled the competing extension.
- Event namehoney_install
Identifies which Honey lifecycle event fired, install or uninstall.
- Browserchrome
The browser you're using, sent alongside every event this extension reports.
- Session tab ID4 (illustrative)
A per-tab session identifier (illustrative; exact value not preserved in evidence); not derived from your account.
- api-e.karmanow.com
Karma's own first-party analytics backend (Alooma-based event pipeline). Receives the Honey install/uninstall detection events alongside the rest of Karma's in-extension analytics.