Is repmafia.net tools safe?
repmafia.net tools rewrites referral cookies and shopping URLs on supported storefronts.
When you visit supported CNFans, AllChinaBuy, Hoobuy, or Kakobuy pages, the extension replaces existing referral or invite parameters with its own codes and sets matching cookies. On CNFans and Kakobuy product pages, it also sends the product page URL to api.finds.ly to retrieve QC photos for display.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Affiliate Cookie & URL Overwrite on Four Shopping Sites
Opening a product page on cnfans.com, hoobuy.com, allchinabuy.com, or kakobuy.com makes this extension write a referral cookie and rewrite the URL with its own code.
One session showed this URL reach the site's Analytics/Ads beacons.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open a product page on cnfans.com, hoobuy.com, allchinabuy.com, or kakobuy.com, possibly from a link that already carries someone else's referral code.
The extension writes its own hardcoded referral cookie and rewrites the URL's referral parameter to its own code, before the page finishes loading.
No click or opt-in is required; this runs on every load of a matching page via a document_end content script.
- cnfans.com referral cookieyith_wcaf_referral_token=150703
Cookie yith_wcaf_referral_token, set to the extension's hardcoded value.
- cnfans.com URL parameter?id=7215417818&ref=150703
The page's ref= parameter after rewrite. Digits-only incumbents are replaced; non-numeric ones stay, with the extension's value appended.
- hoobuy.com referral cookieinviteCode=38VprDXz
Cookie inviteCode, set to the extension's hardcoded value.
- hoobuy.com URL parameterinviteCode=38VprDXz
The page's inviteCode= query parameter after rewrite; any existing value is stripped and replaced.
- allchinabuy.com referral cookieallchinabuyLoginInviteCode=wfE4ak
Cookie allchinabuyLoginInviteCode, set to the extension's hardcoded value.
- allchinabuy.com URL parameterpartnercode=wfE4ak
The page's partnercode= query parameter after rewrite; any existing value is stripped and replaced.
- kakobuy.com referral cookieAFFCODE=repmafiaa
Cookie AFFCODE, set to the extension's hardcoded value.
- kakobuy.com URL parameteraffcode=repmafiaa
The page's affcode= query parameter after rewrite; any existing value is stripped and replaced.
GA4 collect beacon fired by kakobuy.com's own analytics tag. The dl (document location) parameter carries the URL as rewritten by the extension's content script, with affcode=repmafiaa in place of whatever referral parameter was present when the page loaded.
Functions overwriting the referral cookie and URL, from the shipped unminified content.js.
setCookie() — annotated
content.js// Writes a first-party cookie on the current shopping site, valid for 1 year.function setCookie(name, value, days = 365) { let expires = ""; if (days) { const date = new Date(); date.setTime(date.getTime() + (days * 24 * 60 * 60 * 1000)); expires = "; expires=" + date.toUTCString(); } document.cookie = name + "=" + (value || "") + expires + "; path=/; SameSite=Lax";}modifyUrl() — annotated
content.js// Rewrites the visible page URL to carry the extension's own referral code.// Each branch is host-specific and unconditional: there is no check for// whether a referral parameter is already present, who set it, or whether// this visit originated from a competing affiliate's link.function modifyUrl() { const currentUrl = window.location.href; let newUrl = currentUrl; if (currentUrl.includes('cnfans.com')) { // Only strips a NUMERIC ref= value. A non-numeric incumbent code // (e.g. another affiliate's alphanumeric tag) is NOT matched by this // regex, so the extension's own ref=150703 is appended as a SECOND // ref= parameter instead of replacing the first. newUrl = currentUrl.replace(/(&|\?)ref=\d+/, ''); newUrl += newUrl.includes('?') ? '&' : '?'; newUrl += 'ref=150703'; } else if (currentUrl.includes('hoobuy.com/product')) { newUrl = currentUrl.replace(/(&|\?)inviteCode=[^&]+/, ''); newUrl += newUrl.includes('?') ? '&' : '?'; newUrl += 'inviteCode=38VprDXz'; } else if (currentUrl.includes('allchinabuy.com/en/page/buy')) { newUrl = currentUrl.replace(/(&|\?)partnercode=[^&]+/, ''); newUrl += newUrl.includes('?') ? '&' : '?'; newUrl += 'partnercode=wfE4ak'; } else if (currentUrl.includes('kakobuy.com')) { newUrl = currentUrl.replace(/(&|\?)affcode=[^&]+/, ''); newUrl += newUrl.includes('?') ? '&' : '?'; newUrl += 'affcode=repmafiaa'; } // Commits the rewritten URL to the address bar without a network // request or page reload, so it reads exactly like the original link. if (newUrl !== currentUrl) { window.history.replaceState(null, '', newUrl); }}handleCookiesAndUrl() — annotated
content.js// Runs on every page load (document_end) on a matching host.// Sets a hardcoded referral cookie, then calls modifyUrl() to rewrite// the address-bar URL to match.function handleCookiesAndUrl() { const host = window.location.hostname; if (host.includes('cnfans.com')) { setCookie('yith_wcaf_referral_token', '150703'); } else if (host.includes('allchinabuy.com')) { setCookie('allchinabuyLoginInviteCode', 'wfE4ak'); } else if (host.includes('hoobuy.com')) { setCookie('inviteCode', '38VprDXz'); } else if (host.includes('kakobuy.com')) { setCookie('AFFCODE', 'repmafiaa'); } modifyUrl();}- cnfans.com
Receives the overwritten yith_wcaf_referral_token cookie and rewritten ref= URL parameter as its own first-party referral attribution.
- hoobuy.com
Receives the overwritten inviteCode cookie and URL parameter.
- allchinabuy.com
Receives the overwritten allchinabuyLoginInviteCode cookie and rewritten partnercode= URL parameter.
- kakobuy.com
Receives the overwritten AFFCODE cookie and rewritten affcode= URL parameter.
- region1.google-analytics.com
Site-operated Google Analytics endpoint; observed carrying the extension-rewritten URL (including the affcode parameter) in its collect beacon's document-location field.
- www.google.com
Site-operated Google Ads conversion endpoint (/ccm/collect); observed carrying the same extension-rewritten URL.
What it can do
Permissions this extension asks for, as declared in version 1.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on api.finds.ly
https://api.finds.ly/*
Read and change your data on cnfans.com
https://*.cnfans.com/*
Read and change your data on allchinabuy.com
https://*.allchinabuy.com/*
Read and change your data on hoobuy.com
https://*.hoobuy.com/*
Read and change your data on kakobuy.com
https://*.kakobuy.com/*
Where it sends data
Destinations our analysis observed repmafia.net tools contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.finds.ly
repmafia.net tools sends data to api.finds.ly. No other extension we have analysed sends data here.