Is karma Nature safe?
Karma Nature is medium risk. Submitting a query from karma Nature's new-tab search box sends it as a URL parameter to search.loky.ch. A button path also builds a searchpage.com URL with ext=weather2/v=0.0.1 tags, sending terms plus attribution context.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New-tab searches are sent to third-party search services
Submitting a query from karma Nature's new-tab search box sends it as a URL parameter to search.loky.ch.
A button path also builds a searchpage.com URL with ext=weather2/v=0.0.1 tags, sending terms plus attribution context.
You submit a search from the extension's new-tab page.
The search box is part of the page that the extension installs as Chrome's new tab.
The page sends the query to a third-party search service.
A second JavaScript path can build a searchpage.com URL with extension-attribution tags.
| Field | Value | Why it matters | |
|---|---|---|---|
Your search terms | weather tomorrow | This carries what you typed into the new-tab search box. | |
Primary search URL | https://search.loky.ch/search?q=weather | This is where the normal form submission sends your query. | |
Extension tag | ext=weather2 | This can associate the search redirect with this extension's traffic source. | |
Version tag | v=0.0.1 | This adds the routed search flow's version label to the destination URL. | |
Alternate search URL | https://searchpage.com/?ext=weather2&v=0.0.1&keywords=weather | This is the URL the JavaScript handler builds before adding the query text. |
The shipped new-tab form and alternate search redirect path
<div id="search">
<form id="searchform" action="https://search.loky.ch/search?" method="GET">
<input id="searchbox" type="text" name="q" placeholder="SEARCH" autofocus required>
</form>
<div class="ui-autocomplete">
</div>window.addEventListener('load', function(evt) {
// document.getElementById('addBookmark')
// .addEventListener('submit', webSearch);
$("#submitt").click( function() {
webSearch("https://searchpage.com/?ext=weather2&v=0.0.1&keywords=");
});
$("#submitt2").click( function() {
console.log('submit2');
webSearch("https://weather-forecast.live/search/index.php?q=");
});
});
function webSearch(URLs) {
// Cancel the form submit
color = $('#searchbox').val();
$("#searchbox").on("change paste keyup", function() {
color = $(this).val();
console.log(color);
});
$('#submit').click(function(){
console.log(color);
chrome.tabs.query({active:true,currentWindow: true}, function(tabs){
chrome.tabs.sendMessage(tabs[0].id, {todo: "changeColor", clickedColor: color });
});
});
event.preventDefault();
chrome.tabs.getCurrent(function (tab) {
//Your code below...
var myNewUrl = URLs+color;
//Update the url here.
chrome.tabs.update( {url: myNewUrl});
});
}- search.loky.ch
Receives the normal new-tab search form submission with the query in the q parameter.
- searchpage.com
Appears in the bundled JavaScript as an alternate search redirect destination with extension and version tags.
- weather-forecast.live
Appears in the same JavaScript handler as a second alternate search redirect base.
IP address sent to undisclosed geolocation broker on every new tab open
Each new tab triggers a request to json.geoiplookup.io, a third-party geolocation service, deriving coordinates without the geolocation permission.
Your IP is exposed, coordinates forwarded to OpenWeatherMap, undisclosed in the listing.
You open a new browser tab.
The extension replaces chrome://newtab with its own page.
The extension automatically contacts json.geoiplookup.io, exposing your IP address to derive your location.
No interaction is required, the request fires inside $(document).ready() on every new-tab load.
Fires once per new tab open, every time chrome://newtab loads, without any user action.
IP geolocation call in appOpenWeather.js (shipped = deobfuscated, code was not minified)
// Fires immediately on every new tab load.
// No geolocation permission needed — IP is used instead.
// The user's public IP is silently disclosed to json.geoiplookup.io.
$(document).ready(function() {
$.getJSON("https://json.geoiplookup.io/", function(data) {
// data.latitude / data.longitude come from IP-based geolocation
coordinates = data.latitude + "," + data.longitude;
getWeather(data.longitude, data.latitude); // forwards to OpenWeatherMap
});
});- json.geoiplookup.io
IP geolocation broker, receives the user's IP address and returns latitude/longitude. Not disclosed in extension description or privacy policy.
- api.openweathermap.org
Weather data API, receives coordinates derived from IP geolocation. Hardcoded API key (6d85ceceb5bb515beb045b828caba375) is shared across all users.