Is Network Defence safe?
Network Defence fetches an affiliate store list from its server and opens hidden affiliate links on matching sites.
On every page, the extension requests a list of stores and affiliate links from its remote server. When the page URL contains a listed store name, it opens a small popup to a server-supplied affiliate link, redirects it to the store after a few seconds, and closes it. The extension's description does not mention this behavior, and the server controls which sites and links are used.
Strong link to a flagged operator: 1 of the 1 other listing from the same operator is rated high or critical for malicious behaviour. Flagged: Watch Party (high).
Who publishes itUnderpin Extensions - 1 other listing from the same operator, 1 of them carrying a finding
Underpin Extensions - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 5k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Site blocker opens affiliate popups when you visit stores on a remote list
Code analysis shows a script on every page fetches a store list from a remote server and, on a URL match, opens a popup to an affiliate link, then redirects it to the store.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You open a page whose address contains a listed store name.
The extension opens a popup to an affiliate link, then sends it on to the store.
- storeNameexample-store.com
Text matched against the address of the page you are on.
- affilateLinkhttps://affiliate-network.example/track?id=1234
The affiliate link opened first in the popup.
- affilatedStorehttps://example-store.com/
The store page the popup is redirected to after 3 seconds.
- time7
Days to wait before the same rule fires again in this browser.
Match, popup, redirect and close logic in contentScript.js
Match and popup handlers
contentScript.js })) }), []); const t = (e, t) => { console.log(e); const r = window.location.href, o = e.findIndex((e => r.includes(e.storeName))); - 1 !== o && n(e[o], t[0]) }, n = (e, t) => { const n = null == e ? void 0 : e._id, r = 864e5 * (null == e ? void 0 : e.time), o = localStorage.getItem(n), a = Date.now(); if (e && (!o || a - Number(o) > r && e._id === n)) if (t.switchOne) { const t = window.open(e.affilateLink, "_blank"); t.blur(), localStorage.setItem(n, String(a)), setTimeout((() => { t.location.replace(e.affilatedStore), setTimeout((() => { t.close() }), 5e3) }), 3e3) } else { if (!t.switchTwo) return; { const t = "menubar=10,location=0,resizable=0,scrollbars=0,status=0,width=10,height=10", r = window.open(e.affilateLink, "popup", t); localStorage.setItem(n, String(a)), setTimeout((() => { r.location.replace(e.affilatedStore), setTimeout((() => { r.close() }), 5e3) }), 3e3) } } };- extensions-stores-admin.onrender.com
Hosted on Render; supplies the store list (/all) and the on/off switches (/allSwitches).
The extension is described as site blocking and password protection. Its listing does not mention affiliate behaviour. This is code analysis only; no live store list or popup was captured.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Network Defence contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- extensions-stores-admin.onrender.com
Network Defence sends data to extensions-stores-admin.onrender.com. No other extension we have analysed sends data here.