Is Mino - Automatic Coupons safe?

Medium risk

Mino fetches coupon-testing scripts from api.gomino.com and runs them inside shopping pages it visits.

Mino - Automatic Coupons downloads coupon-testing configurations from its own server. Some steps in those configurations are code strings, which the extension compiles and runs in the page's main context on http(s) sites. That code can interact with page content such as cart forms and cookies.

Minov5.5.0Firefox Add-ons
53Risk
Who publishes it

Mino - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Mino
Website
www.gomino.com/

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.gomino.com
Also called by 1 other listing: Mino

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Mino runs code strings from api.gomino.com inside the pages you visit

Code analysis shows the extension downloads recipe code from api.gomino.com and runs it in the page context on shopping sites.

The code can be changed server-side without an extension update.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

A recipe step of type exec arrives from the configuration returned by api.gomino.com.

The extension did this

The extension compiles the step's code string with new Function and runs it in the page's main world.

Where each stage reads its input
  • Config endpoint
    https://api.gomino.com/v1.9/coupon_hunter_code_testing_configs

    Recipes are fetched from the vendor's server, not shipped in the package.

  • Code string
    value / target of an exec step

    The text that gets executed is taken from the config's value or target field.

  • Page reach
    http://*/*, https://*/*

    The content script matches every http and https page apart from a short exclusion list.

  • Exposed resource
    scripts/compiler.js

    compiler.js is web accessible, so it can be loaded as a script in the page.

The code that does this

Content script injects compiler.js and forwards the string

Readable version

Content script appends compiler.js to the page head

content.js
const url = chrome.runtime.getURL("scripts/compiler.js");const id = window.InstanceID + "-compiler";if (document.getElementById(id)) return;const script = document.createElement("script");script.id = id;script.type = "text/javascript";script.src = url;script.setAttribute("data-id", instanceId);document.getElementsByTagName("head")[0].appendChild(script);

Handler runs the received string with new Function

scripts/compiler.js
// only check: message origin equals the page's own originif (origin !== window.location.origin) return;if (type !== FUNCTION_COMPILER_SCRIPT_REQUEST) return;const keys = Object.keys(value);return { result: new Function("$", "window", ...keys, code)(jQuery, window, ...keys.map(k => value[k])) };
Host that supplies the executable strings
    • api.gomino.com

    Mino vendor API (v1.9) returning coupon, cart and instant price recipe configs

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 5.5.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Store data in your browser

    storage

  • Watch every request your browser makes

    webRequest

Where it sends data

Destinations our analysis observed Mino - Automatic Coupons contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.gomino.com

    Mino - Automatic Coupons sends data to api.gomino.com. One other extension we have analysed sends data here.

Updated 15 October 2026amo-2800747