Is Mercado Livre TrueSort a verdadeira ordenação safe?

Medium risk

Mercado Livre TrueSort fetches affiliate-link rules from bembarato.org and rewrites matching links on pages you visit.

Its content script runs on all HTTP and HTTPS pages, except a few Mercado Livre, Gmail, and Shopee pages, and downloads link-rewrite rules from bembarato.org/api/affiliates-links. When a page link matches those rules, it changes the link parameters, adds noreferrer, and sends clicks to the rewritten affiliate URL.

Dilnei Soethe Spancerskiv2.1.63Chrome Web Store
45Risk
Who publishes it

Dilnei Soethe Spancerski - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Dilnei Soethe Spancerski
Registered contact
Dilnei

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Undisclosed Affiliate Link Rewriting on Every Website

TrueSort's content script runs on every HTTP/HTTPS page, not just Mercado Livre.

It fetches 2,000+ affiliate rules from bembarato.org, then every 30s replaces tracking/affiliate tags with its own Awin ID and intercepts clicks.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a link to a store or product page on almost any website, not just Mercado Livre.

The extension did this

Before the click is sent, the extension replaces the link's tracking/affiliate parameters with its own Awin ID and intercepts the click to force navigation to the modified URL.

Runs on any HTTP/HTTPS page except mercadolivre.com.br, mail.google.com, and affiliate.shopee.com.br.

Captured request
GEThttps://bembarato.org/api/affiliates-links

200 OK, ~385,000-byte JSON body containing 2,247 [urlCheck, fullUrl] rule pairs

Page DOM modified

The extension added Awin affiliate-tracking parameters (aw_affid, awc) to the link and set rel=noreferrer, with no indication in the page or the extension's UI that the link had been modified. Clicking it navigated to the real zonky.uk store, which then loaded Awin's cookie-stuffing script and sent a beacon carrying the tagged URL to data.thoughtmetric.io.

Target
a test outbound link added to a non-excluded page (Wikipedia)
Before
<a href="https://zonky.uk/some-product">
After the extension changed it
<a href="https://zonky.uk/some-product?aw_affid=691323&awc=35123_1765958542_bd3ac25cf128f34557022d94d165cfd5" rel="noreferrer">
The code that does this

The functions that fetch the rule list and rewrite matching links.

Readable version

addParameters, translated

function addParameters(url, parameters) {    // If the URL has a fragment (#), leave it alone and return it unchanged    if (url.includes('#')) {        return url;    }    // Tracking parameters this function strips before rewriting    const trackingParams = [        'utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',        'gclid', 'fbclid', 'msclkid', 'ref'    ];    if (url && url.includes("?")) {        let [baseUrl, queryStr] = url.split("?");        let params = new URLSearchParams(queryStr);        // Remove any of the tracking/affiliate params above, including a        // pre-existing affiliate tag such as 'ref'        trackingParams.forEach(param => {            if (params.has(param)) {                params.delete(param);            }        });        // Add the extension's own Awin affiliate parameters        parameters.split("&").forEach((param) => {            let [key, value] = param.split("=");            params.set(key, value);        });        return `${baseUrl}?${params.toString()}`;    } else {        return `${url}?${parameters}`;    }}

updateElementAttributes, translated

async function updateElementAttributes(selector, urlChecks, newParams, attribute = "href") {    let elements = document.querySelectorAll(selector);    elements.forEach((element) => {        if (element.hasAttribute(attribute)) {            let elementUrl = element.getAttribute(attribute);            const urlMatch = urlChecks.some(urlCheck => elementUrl.includes(urlCheck));            if (urlMatch) {                // Skip pagination controls and links already rewritten                let closestElem = element.closest('ul, li');                let isInPagination = closestElem && Array.from(closestElem.classList).some(cls => cls.includes('pagination'));                let isAlreadyProcessed = element.classList.contains('a9899htfrges3j7'); // rewrite marker                if (!isInPagination && !isAlreadyProcessed) {                    let originalUrl = element.getAttribute(attribute);                    let newUrl = addParameters(originalUrl, newParams); // strip + re-tag                    element.setAttribute(attribute, newUrl);                    element.classList.add('a9899htfrges3j7'); // mark as processed                    element.setAttribute('rel', 'noreferrer');                    // Intercept the click and force navigation to the rewritten URL                    element.addEventListener('click', function(event) {                        event.preventDefault();                        window.location.href = newUrl;                    });                }            }        }    });}
Where the rewritten clicks and rule data go
    • bembarato.org

    Serves the remote list of affiliate-link rewrite rules (2,247 entries) that the content script polls and applies on every visited page.

    • data.thoughtmetric.io

    Received a beacon carrying the affiliate-tagged destination URL after a rewritten link was clicked and the merchant page loaded Awin's tracking script.

Check if you're affected

Watches every link on the current page for href changes and logs the before/after value, so you can see the extension's affiliate rewrite happen live on any non-excluded site.

Requires
  • Chrome DevTools
truesort-link-rewrite-detector.js · js
// truesort-link-rewrite-detector.js// Paste into the DevTools console on any page that is NOT// mercadolivre.com.br, mail.google.com, or affiliate.shopee.com.br.// Logs every <a href> change so you can see the extension's rewrite happen.(function () {  const MARKER_CLASS = 'a9899htfrges3j7'; // the extension's own "already rewritten" marker  const seen = new WeakMap();  document.querySelectorAll('a[href]').forEach(a => seen.set(a, a.getAttribute('href')));  const observer = new MutationObserver(mutations => {    for (const m of mutations) {      if (m.type === 'attributes' && m.attributeName === 'href' && m.target.tagName === 'A') {        const before = seen.get(m.target) || '(not seen before)';        const after = m.target.getAttribute('href');        if (before !== after) {          console.log('[LINK_REWRITE]', {            before,            after,            markedByExtension: m.target.classList.contains(MARKER_CLASS),          });          seen.set(m.target, after);        }      }    }  });  observer.observe(document.body, { attributes: true, attributeFilter: ['href'], subtree: true });  console.log('[LINK_REWRITE_DETECTOR] installed. Add or find a store/product link and wait up to 30s.');})();
How to run it
  1. 1Install the extension.
  2. 2Open DevTools on a page other than mercadolivre.com.br, mail.google.com, or affiliate.shopee.com.br.
  3. 3Paste this script.
  4. 4Find/add a product link, wait up to 30s.
  5. 5Watch for [LINK_REWRITE] entries.

Where it sends data

Destinations our analysis observed Mercado Livre True Sort contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • bembarato.org

    Mercado Livre True Sort sends data to bembarato.org. No other extension we have analysed sends data here.

Updated 30 September 2026ihhogidnfaalhknbpnoahmopliehocng