Is karma Nature safe?
Karma Nature is medium risk. Submitting a query from karma Nature's new-tab search box sends it as a URL parameter to search.loky.ch. A button path also builds a searchpage.com URL with ext=weather2/v=0.0.1 tags, sending terms plus attribution context.…
Who publishes itInternet Media - no other listings under this identity, 3 shared hostnames
Internet Media - no other listings under this identity, 3 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New-tab searches are sent to third-party search services
Submitting a query from karma Nature's new-tab search box sends it as a URL parameter to search.loky.ch.
A button path also builds a searchpage.com URL with ext=weather2/v=0.0.1 tags, sending terms plus attribution context.
What actually happens
You submit a search from the extension's new-tab page.
The search box is part of the page that the extension installs as Chrome's new tab.
The page sends the query to a third-party search service.
A second JavaScript path can build a searchpage.com URL with extension-attribution tags.
Search-routing fields in the shipped page
- Your search termsweather tomorrow
This carries what you typed into the new-tab search box.
- Primary search URLhttps://search.loky.ch/search?q=weather
This is where the normal form submission sends your query.
- Extension tagext=weather2
This can associate the search redirect with this extension's traffic source.
- Version tagv=0.0.1
This adds the routed search flow's version label to the destination URL.
- Alternate search URLhttps://searchpage.com/?ext=weather2&v=0.0.1&keywords=weather
This is the URL the JavaScript handler builds before adding the query text.
Captured request
The shipped form defines this GET navigation; no request body is used for the search submission.
Captured request
The shipped JavaScript defines this GET navigation base; the query text is appended to the keywords parameter.
The code that does this
The shipped new-tab form and alternate search redirect path
New-tab form posts searches to search.loky.ch
index.html<div id="search"> <form id="searchform" action="https://search.loky.ch/search?" method="GET"> <input id="searchbox" type="text" name="q" placeholder="SEARCH" autofocus required> </form> <div class="ui-autocomplete"></div>Button handler builds a searchpage.com redirect URL
js/appOpenWeather.jswindow.addEventListener('load', function(evt) { // document.getElementById('addBookmark')// .addEventListener('submit', webSearch); $("#submitt").click( function() { webSearch("https://searchpage.com/?ext=weather2&v=0.0.1&keywords="); }); $("#submitt2").click( function() { console.log('submit2'); webSearch("https://weather-forecast.live/search/index.php?q="); }); });function webSearch(URLs) { // Cancel the form submit color = $('#searchbox').val(); $("#searchbox").on("change paste keyup", function() { color = $(this).val(); console.log(color); }); $('#submit').click(function(){ console.log(color); chrome.tabs.query({active:true,currentWindow: true}, function(tabs){ chrome.tabs.sendMessage(tabs[0].id, {todo: "changeColor", clickedColor: color }); }); }); event.preventDefault(); chrome.tabs.getCurrent(function (tab) { //Your code below... var myNewUrl = URLs+color; //Update the url here. chrome.tabs.update( {url: myNewUrl});});}Third-party search destinations in the claim
- search.loky.ch
Receives the normal new-tab search form submission with the query in the q parameter.
- searchpage.com
Appears in the bundled JavaScript as an alternate search redirect destination with extension and version tags.
- weather-forecast.live
Appears in the same JavaScript handler as a second alternate search redirect base.
IP address sent to undisclosed geolocation broker on every new tab open
Each new tab triggers a request to json.geoiplookup.io, a third-party geolocation service, deriving coordinates without the geolocation permission.
Your IP is exposed, coordinates forwarded to OpenWeatherMap, undisclosed in the listing.
What actually happens
You open a new browser tab.
The extension replaces chrome://newtab with its own page.
The extension automatically contacts json.geoiplookup.io, exposing your IP address to derive your location.
No interaction is required, the request fires inside $(document).ready() on every new-tab load.
When this fires
On every browser startup
Fires once per new tab open, every time chrome://newtab loads, without any user action.
Captured request
{"ip":"203.0.113.4","latitude":50.8284,"longitude":-0.13947,"city":"Brighton","country_name":"United Kingdom","country_code":"GB"}
Captured request
5-day weather forecast JSON for coordinates derived from IP geolocation
The code that does this
IP geolocation call in appOpenWeather.js (shipped = deobfuscated, code was not minified)
// Fires immediately on every new tab load.// No geolocation permission needed — IP is used instead.// The user's public IP is silently disclosed to json.geoiplookup.io.$(document).ready(function() { $.getJSON("https://json.geoiplookup.io/", function(data) { // data.latitude / data.longitude come from IP-based geolocation coordinates = data.latitude + "," + data.longitude; getWeather(data.longitude, data.latitude); // forwards to OpenWeatherMap });});Third-party hosts that receive the user's IP address on every new tab open
- json.geoiplookup.io
IP geolocation broker, receives the user's IP address and returns latitude/longitude. Not disclosed in extension description or privacy policy.
- api.openweathermap.org
Weather data API, receives coordinates derived from IP geolocation. Hardcoded API key (6d85ceceb5bb515beb045b828caba375) is shared across all users.
