Is Panda New Tab safe?
Panda New Tab is medium risk. On sign-in, Panda New Tab builds a message from account email, display name, version, and an IP-geolocation flag, posted to a Supabase edge function (cqxpwemewuetclhbuape) with Telegram chat ID -4939127768. No live body captured.
Who publishes itPanda Network - 3 other listings from the same operator, none carrying a finding
Panda Network - 3 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 52k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Sign-in details are sent to a Telegram relay
On sign-in, Panda New Tab builds a message from account email, display name, version, and an IP-geolocation flag, posted to a Supabase edge function (cqxpwemewuetclhbuape) with Telegram chat ID -4939127768.
No live body captured.
What actually happens
You sign in to the Panda New Tab account flow.
The handler runs when the new-tab page sees a completed signed-in account state.
The extension sends an account notification through a Supabase function to a Telegram chat.
The message contains the account email address, display name when present, a country flag, and the extension version.
Fields assembled for the Telegram relay
- Account email addressava.chen@example.com (illustrative)
This directly identifies the account you used to sign in.
- Account display nameAva Chen (illustrative)
This can identify you by the name saved on the signed-in account.
- IP-derived country flag🇺🇸 (illustrative)
This adds coarse location context to the account notification.
- Extension versionv6.3.61
This ties the notification to the extension build you were running.
- Telegram chat destination-4939127768
This is the destination identifier the extension passes to the relay service.
Captured request
The completed sign-in request body was not captured during dynamic analysis; the endpoint and method are derived from the shipped Supabase Functions call path.
The code that does this
The source path from account sign-in to Telegram relay
Supabase project configured by the deobfuscated bundle
chunks/newtab-BwYtP7l3.jsconst createClient = (supabaseUrl, supabaseKey, options) => { return new SupabaseClient(supabaseUrl, supabaseKey, options);};const supabase = createClient( "https://cqxpwemewuetclhbuape.supabase.co", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNxeHB3ZW1ld3VldGNsaGJ1YXBlIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NDc4OTIyMzcsImV4cCI6MjA2MzQ2ODIzN30.sUJezzZksYtbEgQEWCKuKLB5ZWM8LKlLp5VpnFznTzo");Relay helper that invokes the edge function
chunks/newtab-BwYtP7l3.jsasync function sendTelegramMessage(message, chat_id = CHAT_ID) { if (limitHit) { console.log("Rate limit hit, skipping request"); return; } try { const response = await supabase.functions.invoke("telegram-message", { body: { chat_id, message } }); if (response.error) { if (/(Too Many Requests|Request throttled)/.test(response.error)) { limitHit = true; console.log("Rate limit hit, caching request"); } throw new Error( `Failed to send Telegram message: ${response.error.message}` ); } return response; } catch (err) { if (err instanceof Error && /(Too Many Requests|Request throttled)/.test(err.message)) { limitHit = true; console.log("Rate limit hit, caching request"); } console.error("Error sending telegram message", err); } if (limitHit && !throttleTimer) { throttleTimer = setTimeout(() => { limitHit = false; }, 1e3 * 60); }}Country lookup used in the account notification
chunks/newtab-BwYtP7l3.jsfunction getFlag(code2) { if (!code2) { return "🏳️"; } const codePoints = code2.toUpperCase().split("").map((char) => 127397 + char.charCodeAt(0)); return String.fromCodePoint(...codePoints) || "🏳️";}async function getUserCountry() { let country = lsGet("country"); if (!country) { const res = await fetch("https://api.ipify.org?format=json"); if (res.ok) { const { ip } = await res.json(); if (ip) { const res2 = await fetch(`https://ipinfo.io/${ip}/json`); if (res2.ok) { const { country: country2 } = await res2.json(); lsSet("country", country2); return country2; } } } } return country;}Notification formatter with the Telegram chat ID
chunks/newtab-BwYtP7l3.jsasync function sendNewUserNotification(email, name) { const version2 = "6.3.61"; const country = await getUserCountry(); const flag = getFlag(country); let user = [email, name].filter(Boolean).join(" | "); let message = `${flag} ${user} - v${version2}`; const CHAT_ID2 = "-4939127768"; sendTelegramMessage(message, CHAT_ID2);}Sign-in handler that passes account fields into the notification
chunks/newtab-BwYtP7l3.jsasync function checkAuth() { var _a2; const _url = new URL(window.location.href); const accessToken = (_a2 = _url.hash.split("access_token=")[1]) == null ? void 0 : _a2.split("&")[0]; if (accessToken) { const { data: { subscription } } = supabase.auth.onAuthStateChange( (e2, s2) => { const user = s2 == null ? void 0 : s2.user; if (e2 === "SIGNED_IN" && user) { Zo.capture("login_success", { provider: user.app_metadata.provider || user.app_metadata.providers[0] }); if (!user.user_metadata.remoteKey) { sendNewUserNotification( user.email, user.user_metadata.name ); supabase.auth.updateUser({ data: { ...user.user_metadata, remoteKey: getRemoteSyncKey() } }); } subscription.unsubscribe(); } } ); }}External services involved in the sign-in notification
- cqxpwemewuetclhbuape.supabase.co
Supabase project hosting the telegram-message edge function that receives the chat ID and notification message.
- api.ipify.org
Returns the public IP address used by the country lookup helper.
- ipinfo.io
Returns the country code that the extension converts to a flag in the notification.
- telegram.org
Telegram is the destination service indicated by the telegram-message function name and chat ID passed by the extension.
What it can do
Permissions this extension asks for, as declared in version 6.3.61. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage