Is Mercado Livre TrueSort a verdadeira ordenação safe?
Mercado Livre TrueSort fetches affiliate-link rules from bembarato.org and rewrites matching links on pages you visit.
Its content script runs on all HTTP and HTTPS pages, except a few Mercado Livre, Gmail, and Shopee pages, and downloads link-rewrite rules from bembarato.org/api/affiliates-links. When a page link matches those rules, it changes the link parameters, adds noreferrer, and sends clicks to the rewritten affiliate URL.
Who publishes itDilnei Soethe Spancerski - no other listings under this identity
Dilnei Soethe Spancerski - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Undisclosed Affiliate Link Rewriting on Every Website
TrueSort's content script runs on every HTTP/HTTPS page, not just Mercado Livre.
It fetches 2,000+ affiliate rules from bembarato.org, then every 30s replaces tracking/affiliate tags with its own Awin ID and intercepts clicks.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open a link to a store or product page on almost any website, not just Mercado Livre.
Before the click is sent, the extension replaces the link's tracking/affiliate parameters with its own Awin ID and intercepts the click to force navigation to the modified URL.
Runs on any HTTP/HTTPS page except mercadolivre.com.br, mail.google.com, and affiliate.shopee.com.br.
200 OK, ~385,000-byte JSON body containing 2,247 [urlCheck, fullUrl] rule pairs
The extension added Awin affiliate-tracking parameters (aw_affid, awc) to the link and set rel=noreferrer, with no indication in the page or the extension's UI that the link had been modified. Clicking it navigated to the real zonky.uk store, which then loaded Awin's cookie-stuffing script and sent a beacon carrying the tagged URL to data.thoughtmetric.io.
- Target
- a test outbound link added to a non-excluded page (Wikipedia)
<a href="https://zonky.uk/some-product"><a href="https://zonky.uk/some-product?aw_affid=691323&awc=35123_1765958542_bd3ac25cf128f34557022d94d165cfd5" rel="noreferrer">The functions that fetch the rule list and rewrite matching links.
addParameters, translated
function addParameters(url, parameters) { // If the URL has a fragment (#), leave it alone and return it unchanged if (url.includes('#')) { return url; } // Tracking parameters this function strips before rewriting const trackingParams = [ 'utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'gclid', 'fbclid', 'msclkid', 'ref' ]; if (url && url.includes("?")) { let [baseUrl, queryStr] = url.split("?"); let params = new URLSearchParams(queryStr); // Remove any of the tracking/affiliate params above, including a // pre-existing affiliate tag such as 'ref' trackingParams.forEach(param => { if (params.has(param)) { params.delete(param); } }); // Add the extension's own Awin affiliate parameters parameters.split("&").forEach((param) => { let [key, value] = param.split("="); params.set(key, value); }); return `${baseUrl}?${params.toString()}`; } else { return `${url}?${parameters}`; }}updateElementAttributes, translated
async function updateElementAttributes(selector, urlChecks, newParams, attribute = "href") { let elements = document.querySelectorAll(selector); elements.forEach((element) => { if (element.hasAttribute(attribute)) { let elementUrl = element.getAttribute(attribute); const urlMatch = urlChecks.some(urlCheck => elementUrl.includes(urlCheck)); if (urlMatch) { // Skip pagination controls and links already rewritten let closestElem = element.closest('ul, li'); let isInPagination = closestElem && Array.from(closestElem.classList).some(cls => cls.includes('pagination')); let isAlreadyProcessed = element.classList.contains('a9899htfrges3j7'); // rewrite marker if (!isInPagination && !isAlreadyProcessed) { let originalUrl = element.getAttribute(attribute); let newUrl = addParameters(originalUrl, newParams); // strip + re-tag element.setAttribute(attribute, newUrl); element.classList.add('a9899htfrges3j7'); // mark as processed element.setAttribute('rel', 'noreferrer'); // Intercept the click and force navigation to the rewritten URL element.addEventListener('click', function(event) { event.preventDefault(); window.location.href = newUrl; }); } } } });}- bembarato.org
Serves the remote list of affiliate-link rewrite rules (2,247 entries) that the content script polls and applies on every visited page.
- data.thoughtmetric.io
Received a beacon carrying the affiliate-tagged destination URL after a rewritten link was clicked and the merchant page loaded Awin's tracking script.
Watches every link on the current page for href changes and logs the before/after value, so you can see the extension's affiliate rewrite happen live on any non-excluded site.
- Chrome DevTools
// truesort-link-rewrite-detector.js// Paste into the DevTools console on any page that is NOT// mercadolivre.com.br, mail.google.com, or affiliate.shopee.com.br.// Logs every <a href> change so you can see the extension's rewrite happen.(function () { const MARKER_CLASS = 'a9899htfrges3j7'; // the extension's own "already rewritten" marker const seen = new WeakMap(); document.querySelectorAll('a[href]').forEach(a => seen.set(a, a.getAttribute('href'))); const observer = new MutationObserver(mutations => { for (const m of mutations) { if (m.type === 'attributes' && m.attributeName === 'href' && m.target.tagName === 'A') { const before = seen.get(m.target) || '(not seen before)'; const after = m.target.getAttribute('href'); if (before !== after) { console.log('[LINK_REWRITE]', { before, after, markedByExtension: m.target.classList.contains(MARKER_CLASS), }); seen.set(m.target, after); } } } }); observer.observe(document.body, { attributes: true, attributeFilter: ['href'], subtree: true }); console.log('[LINK_REWRITE_DETECTOR] installed. Add or find a store/product link and wait up to 30s.');})();- 1Install the extension.
- 2Open DevTools on a page other than mercadolivre.com.br, mail.google.com, or affiliate.shopee.com.br.
- 3Paste this script.
- 4Find/add a product link, wait up to 30s.
- 5Watch for [LINK_REWRITE] entries.
Where it sends data
Destinations our analysis observed Mercado Livre True Sort contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- bembarato.org
Mercado Livre True Sort sends data to bembarato.org. No other extension we have analysed sends data here.