Is Panda New Tab safe?
Panda New Tab is medium risk. On sign-in, Panda New Tab builds a message from account email, display name, version, and an IP-geolocation flag, posted to a Supabase edge function (cqxpwemewuetclhbuape) with Telegram chat ID -4939127768. No live body captured.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Sign-in details are sent to a Telegram relay
On sign-in, Panda New Tab builds a message from account email, display name, version, and an IP-geolocation flag, posted to a Supabase edge function (cqxpwemewuetclhbuape) with Telegram chat ID -4939127768.
No live body captured.
You sign in to the Panda New Tab account flow.
The handler runs when the new-tab page sees a completed signed-in account state.
The extension sends an account notification through a Supabase function to a Telegram chat.
The message contains the account email address, display name when present, a country flag, and the extension version.
| Field | Value | Why it matters | |
|---|---|---|---|
Account email address | ava.chen@example.com (illustrative) | This directly identifies the account you used to sign in. | |
Account display name | Ava Chen (illustrative) | This can identify you by the name saved on the signed-in account. | |
IP-derived country flag | 🇺🇸 (illustrative) | This adds coarse location context to the account notification. | |
Extension version | v6.3.61 | This ties the notification to the extension build you were running. | |
Telegram chat destination | -4939127768 | This is the destination identifier the extension passes to the relay service. |
The source path from account sign-in to Telegram relay
const createClient = (supabaseUrl, supabaseKey, options) => {
return new SupabaseClient(supabaseUrl, supabaseKey, options);
};
const supabase = createClient(
"https://cqxpwemewuetclhbuape.supabase.co",
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImNxeHB3ZW1ld3VldGNsaGJ1YXBlIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NDc4OTIyMzcsImV4cCI6MjA2MzQ2ODIzN30.sUJezzZksYtbEgQEWCKuKLB5ZWM8LKlLp5VpnFznTzo"
);async function sendTelegramMessage(message, chat_id = CHAT_ID) {
if (limitHit) {
console.log("Rate limit hit, skipping request");
return;
}
try {
const response = await supabase.functions.invoke("telegram-message", {
body: {
chat_id,
message
}
});
if (response.error) {
if (/(Too Many Requests|Request throttled)/.test(response.error)) {
limitHit = true;
console.log("Rate limit hit, caching request");
}
throw new Error(
`Failed to send Telegram message: ${response.error.message}`
);
}
return response;
} catch (err) {
if (err instanceof Error && /(Too Many Requests|Request throttled)/.test(err.message)) {
limitHit = true;
console.log("Rate limit hit, caching request");
}
console.error("Error sending telegram message", err);
}
if (limitHit && !throttleTimer) {
throttleTimer = setTimeout(() => {
limitHit = false;
}, 1e3 * 60);
}
}function getFlag(code2) {
if (!code2) {
return "🏳️";
}
const codePoints = code2.toUpperCase().split("").map((char) => 127397 + char.charCodeAt(0));
return String.fromCodePoint(...codePoints) || "🏳️";
}
async function getUserCountry() {
let country = lsGet("country");
if (!country) {
const res = await fetch("https://api.ipify.org?format=json");
if (res.ok) {
const { ip } = await res.json();
if (ip) {
const res2 = await fetch(`https://ipinfo.io/${ip}/json`);
if (res2.ok) {
const { country: country2 } = await res2.json();
lsSet("country", country2);
return country2;
}
}
}
}
return country;
}async function sendNewUserNotification(email, name) {
const version2 = "6.3.61";
const country = await getUserCountry();
const flag = getFlag(country);
let user = [email, name].filter(Boolean).join(" | ");
let message = `${flag} ${user} - v${version2}`;
const CHAT_ID2 = "-4939127768";
sendTelegramMessage(message, CHAT_ID2);
}async function checkAuth() {
var _a2;
const _url = new URL(window.location.href);
const accessToken = (_a2 = _url.hash.split("access_token=")[1]) == null ? void 0 : _a2.split("&")[0];
if (accessToken) {
const { data: { subscription } } = supabase.auth.onAuthStateChange(
(e2, s2) => {
const user = s2 == null ? void 0 : s2.user;
if (e2 === "SIGNED_IN" && user) {
Zo.capture("login_success", {
provider: user.app_metadata.provider || user.app_metadata.providers[0]
});
if (!user.user_metadata.remoteKey) {
sendNewUserNotification(
user.email,
user.user_metadata.name
);
supabase.auth.updateUser({
data: {
...user.user_metadata,
remoteKey: getRemoteSyncKey()
}
});
}
subscription.unsubscribe();
}
}
);
}
}- cqxpwemewuetclhbuape.supabase.co
Supabase project hosting the telegram-message edge function that receives the chat ID and notification message.
- api.ipify.org
Returns the public IP address used by the country lookup helper.
- ipinfo.io
Returns the country code that the extension converts to a flag in the notification.
- telegram.org
Telegram is the destination service indicated by the telegram-message function name and chat ID passed by the extension.