Is Official Card Counter Trello with Totalizer safe?

Medium risk

Official Card Counter Trello with Totalizer redirects visits to shopping sites through affiliate links.

The extension runs a content script on all sites and, when a page matches supported merchant domains, rewrites the visit through affiliate redirectors or injects a hidden AliExpress iframe. Those redirectors can receive the visited merchant URL; cookies throttle most redirects, but the behavior is separate from Trello card counting.

Henrique Brugugnoliv7.3Chrome Web Store
45Risk
Who publishes it

Henrique Brugugnoli - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Henrique Brugugnoli
Website
www.officialtrellocardcounter.com.br/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

All-Site Content Script Redirects Shopping Visits Through Affiliate Links

This content script runs on every HTTP/HTTPS page, not just Trello.

On dozens of hardcoded domains it rewrites the location to an affiliate redirect or adds a 1x1 iframe firing a click, e.g. americanas.com.br to redir.lomadee.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You navigate to a page on one of dozens of hardcoded merchant, travel, or marketplace domains, such as americanas.com.br, netshoes.com.br, or aliexpress.com.

The extension did this

The content script checks the page URL against a hardcoded merchant list and rewrites the location to an affiliate redirect, or adds a 1x1 iframe that fires an affiliate click.

This runs on every matching page load across the whole web, independent of whether you are using Trello, which is the extension's stated purpose.

Captured request
GEThttps://redir.lomadee.com/v2/deeplink?sourceId=36886602&url=https://www.americanas.com.br/

Content-script-initiated request (source=cs); the page you were visiting is carried verbatim in the url= parameter and the request redirects on to the merchant site carrying Lomadee's affiliate ID.

The same pattern repeats across the hardcoded merchant table

  1. immediate

    You did

    You visit americanas.com.br.

    The extension did

    Redirected to redir.lomadee.com/v2/deeplink with the visited URL attached.

  2. immediate

    You did

    You visit netshoes.com.br, centauro.com.br, or sephora.com.br.

    The extension did

    Redirected to click.linksynergy.com/deeplink with the visited URL in murl=.

  3. immediate

    You did

    You visit dafiti.com.br, cea.com.br, clickbus.com.br, or several other listed domains.

    The extension did

    Redirected to www.awin1.com/cread.php with the visited URL in ued= and awinaffid=1203832.

  4. immediate

    You did

    You visit aliexpress.com.

    The extension did

    A 1x1 pixel iframe pointed at s.click.aliexpress.com/e/_DBSKNRz is added to the page. This branch is not gated by the 3-day cookie throttle.

  5. immediate

    You did

    You visit hotmart.com on a URL that already carries a different affiliate's ref= value.

    The extension did

    The existing ref= value is overwritten with the extension's own hardcoded ID (63510) before the redirect fires.

The code that does this

The merchant-matching code, from the extension's own JavaScript source (not minified or obfuscated).

Readable version

Automatic redirect on americanas.com.br

// Runs on every page load on an americanas.com.br URL.else if (url.href.indexOf(".americanas.com.br") > 0) {  const affiliateUrl = "https://redir.lomadee.com/v2/deeplink?sourceId=36886602&url=" + url;  // controlCoockie [sic, matches the shipped identifier] sets a 3-day cookie  // and returns true only the first time it's called for this merchant,  // throttling the redirect.  if (controlCoockie("americanas", 3)) {    window.location.href = affiliateUrl; // navigates the tab through the affiliate link  }}

Overwrite of an existing affiliate ID on hotmart.com

// Runs on every page load on a hotmart.com URL. Not gated by controlCookie.else if (url.href.indexOf("hotmart.com") > 0) {  // Only act if the extension's own affiliate ID (63510) isn't already present.  if (url.href.indexOf("63510") <= 0) {    if (url.href.indexOf("ref=") > 0) {      // Splice the extension's own ID into the existing ref= value, replacing      // whichever affiliate ID was already there.      window.location.href =        url.href.substring(0, url.href.indexOf("ref=") + 5) +        "63510" +        url.href.substring(url.href.indexOf("ref=") + 10);    }  }}
Where visited-page URLs and affiliate clicks are sent
    • redir.lomadee.com

    Lomadee affiliate network. Receives the visited URL for americanas.com.br, gearbest.com, alibaba.com and other listed domains in url=.

    • click.linksynergy.com

    Rakuten Advertising (LinkSynergy) affiliate network. Receives the visited URL for netshoes.com.br, centauro.com.br, and sephora.com.br in murl=.

    • www.awin1.com

    Awin affiliate network. Receives the visited URL for dafiti.com.br, cea.com.br, clickbus.com.br, drogasil.com.br, and other listed domains, tagged awinaffid=1203832.

    • s.click.aliexpress.com

    AliExpress's own affiliate click endpoint, loaded via a 1x1 pixel iframe added to every aliexpress.com page.

    • stvkr.com

    Affiliate redirector used for alibaba.com traffic.

Check if you're affected

Detects the redirect and iframe-injection behavior described above by watching for network requests to the affiliate hosts and for iframes added to the page.

Requires
  • Chrome DevTools
affiliate-redirect-detector.js · js
(function () {  const AFFILIATE_HOSTS = [    'redir.lomadee.com',    'click.linksynergy.com',    'www.awin1.com',    's.click.aliexpress.com',    'stvkr.com'  ];  function checkResourceTiming() {    performance.getEntriesByType('resource').forEach((entry) => {      if (AFFILIATE_HOSTS.some((h) => entry.name.includes(h))) {        console.warn('[AFFILIATE_REDIRECT] request to', entry.name);      }    });  }  new MutationObserver((mutations) => {    for (const m of mutations) {      for (const node of m.addedNodes) {        if (node.tagName === 'IFRAME' && node.src) {          console.warn('[AFFILIATE_REDIRECT] iframe added:', node.src);        }      }    }    checkResourceTiming();  }).observe(document.documentElement, { childList: true, subtree: true });  setInterval(checkResourceTiming, 1000);  console.log('[AFFILIATE_REDIRECT_DETECTOR] installed. Navigate to a matched merchant page (e.g. americanas.com.br) and watch the console.');})();
How to run it
  1. 1Install in a fresh profile.
  2. 2Open DevTools on any page, paste this script before navigating.
  3. 3Navigate to a matched page like americanas.com.br or aliexpress.com.
  4. 4Watch console for [AFFILIATE_REDIRECT].

Where it sends data

Destinations our analysis observed Official Card Counter Trello with Totalizer contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • s.click.aliexpress.com

    Official Card Counter Trello with Totalizer sends data to s.click.aliexpress.com. 24 other extensions we have analysed send data here.

  • www.awin1.com

    Official Card Counter Trello with Totalizer sends data to www.awin1.com. 4 other extensions we have analysed send data here.

  • click.linksynergy.com

    Official Card Counter Trello with Totalizer sends data to click.linksynergy.com. One other extension we have analysed sends data here.

  • redir.lomadee.com

    Official Card Counter Trello with Totalizer sends data to redir.lomadee.com. No other extension we have analysed sends data here.

  • stvkr.com

    Official Card Counter Trello with Totalizer sends data to stvkr.com. No other extension we have analysed sends data here.

Updated 30 September 2026jbdmgabkegidhagemkfdogmplgelaoab