Is RatePunk Hotel Booking Deals safe?

Medium risk

RatePunk records every page's URL and sends hotel searches and prices to its servers, which can also direct it to fetch arbitrary URLs.

On every site you visit, RatePunk's content script writes the full page URL and a timestamp into local storage. On hotel and booking pages it scrapes hotel names, dates, occupancy and live prices (including the booking.com reserve price) and posts them to hotel-scraper.onrender.com and extension-analyzer.onrender.com, and it silently redirects bookings through affiliate-tagged links built from a remote config. Its background worker also honors a 'make_request' instruction from hotel-scraper.onrender.com: the server can tell the extension to fetch an arbitrary URL and return the response, repeating up to three times.

yard-venturev1.49.8Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Full-URL Browsing Log Written on Every Page You Visit

We observed RatePunk write the full URL of every page you load, on any site, to storage as lastVisits with a timestamp, keeping the two most recent pages.

This buffer is read on booking sites to decide whether to auto-apply a referral.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You load any webpage while the extension is installed.

This fires on every site, not only travel or booking pages; the content script is injected into <all_urls>.

The extension did this

The extension records the page's full URL and a timestamp to local storage.

chrome.storage.local.lastVisits is overwritten with a rolling 2-entry buffer holding the current page and the one before it.

02EvidenceCODE COMPARE
The code that does this

initialize.bundle.js, the <all_urls> content script that writes lastVisits on every page load

What it actually does
window.addEventListener("load", (() => {
  ((t, e) => {
    const r = document.querySelector("html");
    r.getAttribute(t) || (r.setAttribute(t, !0), (async () => {
      const {
        lastVisits: t
      } = await ((t, e = "local") => new Promise(((r, n) => chrome.storage[e].get(...t, (t => r(t))))))(["lastVisits"]), e = new Date;
      t ? chrome.storage.local.set({
        lastVisits: [{
          url: window.location.href,
          date: e.toISOString()
        }, t[0]]
      }) : chrome.storage.local.set({
        lastVisits: [{
          url: window.location.href,
          date: e.toISOString()
        }]
      })
    })())
  })("rp-extension")
}))
03EvidenceSTORAGE DUMP
What's stored on your device

chrome.storage.local after visiting agoda.com, expedia.com, priceline.com: only the two most recent URLs remain, earlier ones overwritten.

Locationchrome.storage.local key 'lastVisits', observed after browsing agoda.com, expedia.com, and priceline.com in one dynamic-analysis session
Contents (JSON)
{
  "lastVisits": [
    {
      "url": "https://www.priceline.com/",
      "date": "2026-08-16T11:44:07.203Z"
    },
    {
      "url": "https://www.priceline.com/",
      "date": "2026-08-16T11:43:52.871Z"
    }
  ]
}
04EvidenceFIELD TABLE
What's captured in each lastVisits entry
FieldValueWhy it matters
Page URL
https://www.priceline.com/drive/results?pickupLocation=SFOThe full address of the page you're on, including path and query, enough to identify the specific page and search you viewed.
Visit timestamp
2026-08-16T11:44:07.203ZThe exact moment you loaded that page.
05EvidenceCAUSE EFFECT
What actually happens
You did this

You land on a supported booking site, such as booking.com.

The affiliate content script for that site (e.g. booking.bundle.js) loads and checks the stored lastVisits buffer before acting.

The extension did this

The extension reads the last two recorded page URLs to decide whether to auto-apply a referral redirect.

If the previously recorded URL already matches the booking site's own domain, the extension treats you as already redirected and skips applying a second referral link.

Data recipients

hotel-scraper.onrender.comhotel-scraper-eu.onrender.comextension-analyzer.onrender.comipapi.co
Updated 17 September 2026gdaioanblcnghddimngklkhgcbomfdck