Is Panda New Tab safe?

Medium risk

Panda New Tab is medium risk. On sign-in, Panda New Tab builds a message from account email, display name, version, and an IP-geolocation flag, posted to a Supabase edge function (cqxpwemewuetclhbuape) with Telegram chat ID -4939127768. No live body captured.

Panda Networkv6.3.61Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Sign-in details are sent to a Telegram relay

On sign-in, Panda New Tab builds a message from account email, display name, version, and an IP-geolocation flag, posted to a Supabase edge function (cqxpwemewuetclhbuape) with Telegram chat ID -4939127768.

No live body captured.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You sign in to the Panda New Tab account flow.

The handler runs when the new-tab page sees a completed signed-in account state.

The extension did this

The extension sends an account notification through a Supabase function to a Telegram chat.

The message contains the account email address, display name when present, a country flag, and the extension version.

02EvidenceFIELD TABLE
Fields assembled for the Telegram relay
FieldValueWhy it matters
Account email address
ava.chen@example.com (illustrative)This directly identifies the account you used to sign in.
Account display name
Ava Chen (illustrative)This can identify you by the name saved on the signed-in account.
IP-derived country flag
🇺🇸 (illustrative)This adds coarse location context to the account notification.
Extension version
v6.3.61This ties the notification to the extension build you were running.
Telegram chat destination
-4939127768This is the destination identifier the extension passes to the relay service.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://cqxpwemewuetclhbuape.supabase.co/functions/v1/telegram-message
The completed sign-in request body was not captured during dynamic analysis; the endpoint and method are derived from the shipped Supabase Functions call path.
04EvidenceCODE COMPARE
The code that does this

The source path from account sign-in to Telegram relay

What it actually does
Supabase project configured by the deobfuscated bundlechunks/newtab-BwYtP7l3.js
const createClient = (supabaseUrl, supabaseKey, options) => {
  return new SupabaseClient(supabaseUrl, supabaseKey, options);
};
const supabase = createClient(
  "https://cqxpwemewuetclhbuape.supabase.co",
  "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNxeHB3ZW1ld3VldGNsaGJ1YXBlIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NDc4OTIyMzcsImV4cCI6MjA2MzQ2ODIzN30.sUJezzZksYtbEgQEWCKuKLB5ZWM8LKlLp5VpnFznTzo"
);
Relay helper that invokes the edge functionchunks/newtab-BwYtP7l3.js
async function sendTelegramMessage(message, chat_id = CHAT_ID) {
  if (limitHit) {
    console.log("Rate limit hit, skipping request");
    return;
  }
  try {
    const response = await supabase.functions.invoke("telegram-message", {
      body: {
        chat_id,
        message
      }
    });
    if (response.error) {
      if (/(Too Many Requests|Request throttled)/.test(response.error)) {
        limitHit = true;
        console.log("Rate limit hit, caching request");
      }
      throw new Error(
        `Failed to send Telegram message: ${response.error.message}`
      );
    }
    return response;
  } catch (err) {
    if (err instanceof Error && /(Too Many Requests|Request throttled)/.test(err.message)) {
      limitHit = true;
      console.log("Rate limit hit, caching request");
    }
    console.error("Error sending telegram message", err);
  }
  if (limitHit && !throttleTimer) {
    throttleTimer = setTimeout(() => {
      limitHit = false;
    }, 1e3 * 60);
  }
}
Country lookup used in the account notificationchunks/newtab-BwYtP7l3.js
function getFlag(code2) {
  if (!code2) {
    return "🏳️";
  }
  const codePoints = code2.toUpperCase().split("").map((char) => 127397 + char.charCodeAt(0));
  return String.fromCodePoint(...codePoints) || "🏳️";
}
async function getUserCountry() {
  let country = lsGet("country");
  if (!country) {
    const res = await fetch("https://api.ipify.org?format=json");
    if (res.ok) {
      const { ip } = await res.json();
      if (ip) {
        const res2 = await fetch(`https://ipinfo.io/${ip}/json`);
        if (res2.ok) {
          const { country: country2 } = await res2.json();
          lsSet("country", country2);
          return country2;
        }
      }
    }
  }
  return country;
}
Notification formatter with the Telegram chat IDchunks/newtab-BwYtP7l3.js
async function sendNewUserNotification(email, name) {
  const version2 = "6.3.61";
  const country = await getUserCountry();
  const flag = getFlag(country);
  let user = [email, name].filter(Boolean).join(" | ");
  let message = `${flag} ${user} - v${version2}`;
  const CHAT_ID2 = "-4939127768";
  sendTelegramMessage(message, CHAT_ID2);
}
Sign-in handler that passes account fields into the notificationchunks/newtab-BwYtP7l3.js
async function checkAuth() {
  var _a2;
  const _url = new URL(window.location.href);
  const accessToken = (_a2 = _url.hash.split("access_token=")[1]) == null ? void 0 : _a2.split("&")[0];
  if (accessToken) {
    const { data: { subscription } } = supabase.auth.onAuthStateChange(
      (e2, s2) => {
        const user = s2 == null ? void 0 : s2.user;
        if (e2 === "SIGNED_IN" && user) {
          Zo.capture("login_success", {
            provider: user.app_metadata.provider || user.app_metadata.providers[0]
          });
          if (!user.user_metadata.remoteKey) {
            sendNewUserNotification(
              user.email,
              user.user_metadata.name
            );
            supabase.auth.updateUser({
              data: {
                ...user.user_metadata,
                remoteKey: getRemoteSyncKey()
              }
            });
          }
          subscription.unsubscribe();
        }
      }
    );
  }
}
05EvidenceTHIRD PARTY LIST
External services involved in the sign-in notification
  • cqxpwemewuetclhbuape.supabase.co

    Supabase project hosting the telegram-message edge function that receives the chat ID and notification message.

  • api.ipify.org

    Returns the public IP address used by the country lookup helper.

  • ipinfo.io

    Returns the country code that the extension converts to a flag in the notification.

  • telegram.org

    Telegram is the destination service indicated by the telegram-message function name and chat ID passed by the extension.

Updated 17 September 2026haafibkemckmbknhfkiiniobjpgkebko