Is repmafia.net tools safe?

Medium risk

repmafia.net tools rewrites referral cookies and shopping URLs on supported storefronts.

When you visit supported CNFans, AllChinaBuy, Hoobuy, or Kakobuy pages, the extension replaces existing referral or invite parameters with its own codes and sets matching cookies. On CNFans and Kakobuy product pages, it also sends the product page URL to api.finds.ly to retrieve QC photos for display.

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Affiliate Cookie & URL Overwrite on Four Shopping Sites

Opening a product page on cnfans.com, hoobuy.com, allchinabuy.com, or kakobuy.com makes this extension write a referral cookie and rewrite the URL with its own code.

One session showed this URL reach the site's Analytics/Ads beacons.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open a product page on cnfans.com, hoobuy.com, allchinabuy.com, or kakobuy.com, possibly from a link that already carries someone else's referral code.

The extension did this

The extension writes its own hardcoded referral cookie and rewrites the URL's referral parameter to its own code, before the page finishes loading.

No click or opt-in is required; this runs on every load of a matching page via a document_end content script.

The referral cookie and URL parameter the extension writes per site
  • cnfans.com referral cookie
    yith_wcaf_referral_token=150703

    Cookie yith_wcaf_referral_token, set to the extension's hardcoded value.

  • cnfans.com URL parameter
    ?id=7215417818&ref=150703

    The page's ref= parameter after rewrite. Digits-only incumbents are replaced; non-numeric ones stay, with the extension's value appended.

  • hoobuy.com referral cookie
    inviteCode=38VprDXz

    Cookie inviteCode, set to the extension's hardcoded value.

  • hoobuy.com URL parameter
    inviteCode=38VprDXz

    The page's inviteCode= query parameter after rewrite; any existing value is stripped and replaced.

  • allchinabuy.com referral cookie
    allchinabuyLoginInviteCode=wfE4ak

    Cookie allchinabuyLoginInviteCode, set to the extension's hardcoded value.

  • allchinabuy.com URL parameter
    partnercode=wfE4ak

    The page's partnercode= query parameter after rewrite; any existing value is stripped and replaced.

  • kakobuy.com referral cookie
    AFFCODE=repmafiaa

    Cookie AFFCODE, set to the extension's hardcoded value.

  • kakobuy.com URL parameter
    affcode=repmafiaa

    The page's affcode= query parameter after rewrite; any existing value is stripped and replaced.

Captured request
GEThttps://region1.google-analytics.com/g/collect?...&dl=https%3A%2F%2Fkakobuy.com%2F%3Faffcode%3Drepmafiaa&...

GA4 collect beacon fired by kakobuy.com's own analytics tag. The dl (document location) parameter carries the URL as rewritten by the extension's content script, with affcode=repmafiaa in place of whatever referral parameter was present when the page loaded.

The code that does this

Functions overwriting the referral cookie and URL, from the shipped unminified content.js.

Readable version

setCookie() — annotated

content.js
// Writes a first-party cookie on the current shopping site, valid for 1 year.function setCookie(name, value, days = 365) {  let expires = "";  if (days) {    const date = new Date();    date.setTime(date.getTime() + (days * 24 * 60 * 60 * 1000));    expires = "; expires=" + date.toUTCString();  }  document.cookie = name + "=" + (value || "") + expires + "; path=/; SameSite=Lax";}

modifyUrl() — annotated

content.js
// Rewrites the visible page URL to carry the extension's own referral code.// Each branch is host-specific and unconditional: there is no check for// whether a referral parameter is already present, who set it, or whether// this visit originated from a competing affiliate's link.function modifyUrl() {  const currentUrl = window.location.href;  let newUrl = currentUrl;  if (currentUrl.includes('cnfans.com')) {    // Only strips a NUMERIC ref= value. A non-numeric incumbent code    // (e.g. another affiliate's alphanumeric tag) is NOT matched by this    // regex, so the extension's own ref=150703 is appended as a SECOND    // ref= parameter instead of replacing the first.    newUrl = currentUrl.replace(/(&|\?)ref=\d+/, '');    newUrl += newUrl.includes('?') ? '&' : '?';    newUrl += 'ref=150703';  }   else if (currentUrl.includes('hoobuy.com/product')) {    newUrl = currentUrl.replace(/(&|\?)inviteCode=[^&]+/, '');    newUrl += newUrl.includes('?') ? '&' : '?';    newUrl += 'inviteCode=38VprDXz';  }   else if (currentUrl.includes('allchinabuy.com/en/page/buy')) {    newUrl = currentUrl.replace(/(&|\?)partnercode=[^&]+/, '');    newUrl += newUrl.includes('?') ? '&' : '?';    newUrl += 'partnercode=wfE4ak';  }  else if (currentUrl.includes('kakobuy.com')) {    newUrl = currentUrl.replace(/(&|\?)affcode=[^&]+/, '');    newUrl += newUrl.includes('?') ? '&' : '?';    newUrl += 'affcode=repmafiaa';  }  // Commits the rewritten URL to the address bar without a network  // request or page reload, so it reads exactly like the original link.  if (newUrl !== currentUrl) {    window.history.replaceState(null, '', newUrl);  }}

handleCookiesAndUrl() — annotated

content.js
// Runs on every page load (document_end) on a matching host.// Sets a hardcoded referral cookie, then calls modifyUrl() to rewrite// the address-bar URL to match.function handleCookiesAndUrl() {  const host = window.location.hostname;  if (host.includes('cnfans.com')) {    setCookie('yith_wcaf_referral_token', '150703');  } else if (host.includes('allchinabuy.com')) {    setCookie('allchinabuyLoginInviteCode', 'wfE4ak');  } else if (host.includes('hoobuy.com')) {    setCookie('inviteCode', '38VprDXz');  } else if (host.includes('kakobuy.com')) {    setCookie('AFFCODE', 'repmafiaa');  }  modifyUrl();}
Where the overwritten referral code ends up
    • cnfans.com

    Receives the overwritten yith_wcaf_referral_token cookie and rewritten ref= URL parameter as its own first-party referral attribution.

    • hoobuy.com

    Receives the overwritten inviteCode cookie and URL parameter.

    • allchinabuy.com

    Receives the overwritten allchinabuyLoginInviteCode cookie and rewritten partnercode= URL parameter.

    • kakobuy.com

    Receives the overwritten AFFCODE cookie and rewritten affcode= URL parameter.

    • region1.google-analytics.com

    Site-operated Google Analytics endpoint; observed carrying the extension-rewritten URL (including the affcode parameter) in its collect beacon's document-location field.

    • www.google.com

    Site-operated Google Ads conversion endpoint (/ccm/collect); observed carrying the same extension-rewritten URL.

What it can do

Permissions this extension asks for, as declared in version 1.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on api.finds.ly

    https://api.finds.ly/*

  • Read and change your data on cnfans.com

    https://*.cnfans.com/*

  • Read and change your data on allchinabuy.com

    https://*.allchinabuy.com/*

  • Read and change your data on hoobuy.com

    https://*.hoobuy.com/*

  • Read and change your data on kakobuy.com

    https://*.kakobuy.com/*

Where it sends data

Destinations our analysis observed repmafia.net tools contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.finds.ly

    repmafia.net tools sends data to api.finds.ly. No other extension we have analysed sends data here.

Updated 30 September 2026fhnipbfceheogaejbdnonohphfbiegnj