Is ShopNow safe?
ShopNow replaces the default search engine and injects a cookie-derived affiliate tracking parameter into navigations to alphashopnow.co.
On installation, the extension reads a cookie named 'id' from alphashopnow.co and uses its value to configure a declarativeNetRequest redirect rule. Any subsequent main-frame navigation to alphashopnow.co has an 'atr' query parameter appended, encoding the cookie value as an affiliate identifier. The extension also sets alphashopnow.co as the browser's default search provider.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
ShopNow adds a cookie value to AlphaShopNow URLs
When ShopNow is installed, its service worker reads the AlphaShopNow id cookie if present, URI-encodes it into the atr query parameter, and installs a rule so navigations to alphashopnow.co carry that value in the URL.
What actually happens
You install ShopNow while alphashopnow.co has an id cookie in your browser.
The extension reads that cookie value and configures AlphaShopNow page loads to include it as an atr URL parameter.
Fields written into matching AlphaShopNow navigations
- AlphaShopNow cookie valueshopper-id-12345 (illustrative)
This connects the page request to an existing browser cookie for the same site.
- AlphaShopNow page URLhttps://alphashopnow.co/products/example?atr=shopper-id-12345 (illustrative)
This shows which page you are loading when the cookie-derived parameter is attached.
- Attribution parameteratr=shopper-id-12345 (illustrative)
This is the URL field that carries the cookie value on matching navigations.
Captured request
The code that does this
Install handler reads the cookie and writes it into the navigation rule
Readable service worker logic
deobfuscated/js/service_worker.jschrome.runtime.onInstalled.addListener(function (details) { chrome.cookies.get({url: "https://alphashopnow.co", name: "id"},function(id) { if (id) { cohort(id.value); } });});function cohort(id) { fetch( chrome.runtime.getURL('rules.json')) .then(r => { return r.json(); }) .then(j => { j.addRules[0].action.redirect.transform.queryTransform.addOrReplaceParams[0].value = encodeURIComponent(id); chrome.declarativeNetRequest.updateDynamicRules(j); });}Readable dynamic rule template
deobfuscated/rules.json{ "addRules":[ { "id": 1, "priority": 1, "condition": { "regexFilter": "^https://alphashopnow.co/", "resourceTypes": ["main_frame"] }, "action": { "type": "redirect", "redirect": { "transform": { "queryTransform": { "addOrReplaceParams": [ {"key": "atr", "value": ""} ] } } } } } ], "removeRuleIds": [1]}External destination reached by the modified navigation
- alphashopnow.co
Receives matching main-frame navigations after the extension appends the cookie-derived atr query parameter.
What it can do
Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on alphashopnow.co
https://alphashopnow.co/*
Block and redirect the requests your browser makes
declarativeNetRequest
Read and change cookies, including the ones that keep you signed in
cookies
Where it sends data
Destinations our analysis observed ShopNow contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- alphashopnow.co
ShopNow sends data to alphashopnow.co. No other extension we have analyzed sends data here.