Is Monitix – Stock & Crypto Price Alert & Tracker safe?
Monitix embeds the Mellowtel SDK, which loads server-chosen URLs in hidden iframes after the user opts in.
After the user opts in to lift the 5-symbol limit, the extension connects to ws.mellow.tel and receives URLs to load in hidden frames. It rewrites request headers and cookies for those pages, can inject server-supplied scripts, and posts the page results to AWS Lambda endpoints. The opt-in prompt describes this only as using unused bandwidth.
Who publishes it11 other listings from the same operator, 10 of them carrying a finding
11 other listings from the same operator, 10 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
11 other listings published from this account, 2k+ users between them. 10 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Mellowtel SDK lets a remote server load pages in off-screen frames after opt-in
Code analysis shows the extension embeds the Mellowtel SDK.
After opt-in it connects to ws.mellow.tel and loads server-chosen URLs in off-screen frames, with cookie header rewriting.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Static analysis
You accept the opt-in prompt that is tied to lifting the free-tier symbol limit.
The prompt describes sharing unused bandwidth.
The extension opens a websocket to ws.mellow.tel and starts loading URLs the server chooses in off-screen frames.
Cookie headers for the target domain are rewritten before each load.
SDK construction and opt-in gate
Websocket endpoint
dist/background.jsUs = "wss://ws.mellow.tel", Ms = [3e4, 6e4, 3e5, 6e5, 12e5, 36e5]Opt-in storage key
dist/background.jshs = "mellowtelOptIn"Server-driven cookie rules and script injection
Server object drives an injected script
dist/background.jss.src = a, null != (n = t.xhr_options) && n.include_urls && s.setAttribute("include-urls", t.xhr_options.include_urls.join(",")), s.setAttribute("burke-id", e.data.recordID), s.setAttribute("api-endpoint", t.endpoint), document.head.appendChild(s)- Target URLurl
The page the extension is told to load in an off-screen frame.
- Record IDrecordID
Identifier tying the page result to the server job.
- Page-handling objectsburkeObject, bCrewObject, cerealObject
Server objects that configure script injection and the upload endpoint.
- Cookie jarCookie / Set-Cookie rules
Cookies fetched from a Lambda endpoint and applied to the target domain.
- ws.mellow.tel
Websocket that delivers crawl jobs to the extension.
- api.mellow.tel
Approval endpoint used by the SDK.
- lambda-url.us-east-1.on.aws
AWS Lambda endpoints that supply cookie jars and receive page results.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Monitix – Stock & Crypto Price Alert & Tracker contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ws.mellow.tel
Monitix – Stock & Crypto Price Alert & Tracker sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.
- lambda-url.us-east-1.on.aws
Monitix – Stock & Crypto Price Alert & Tracker sends data to lambda-url.us-east-1.on.aws. No other extension we have analysed sends data here.