Is ShopNow safe?

Medium risk

ShopNow replaces the default search engine and injects a cookie-derived affiliate tracking parameter into navigations to alphashopnow.co.

On installation, the extension reads a cookie named 'id' from alphashopnow.co and uses its value to configure a declarativeNetRequest redirect rule. Any subsequent main-frame navigation to alphashopnow.co has an 'atr' query parameter appended, encoding the cookie value as an affiliate identifier. The extension also sets alphashopnow.co as the browser's default search provider.

ShopNowv1.0.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

ShopNow adds a cookie value to AlphaShopNow URLs

When ShopNow is installed, its service worker reads the AlphaShopNow `id` cookie if present, URI-encodes it into the `atr` query parameter, and installs a rule so navigations to `alphashopnow.co` carry that value in the URL.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install ShopNow while alphashopnow.co has an `id` cookie in your browser.

The extension did this

The extension reads that cookie value and configures AlphaShopNow page loads to include it as an `atr` URL parameter.

02EvidenceFIELD TABLE
Fields written into matching AlphaShopNow navigations
FieldValueWhy it matters
AlphaShopNow cookie value
shopper-id-12345 (illustrative)This connects the page request to an existing browser cookie for the same site.
AlphaShopNow page URL
https://alphashopnow.co/products/example?atr=shopper-id-12345 (illustrative)This shows which page you are loading when the cookie-derived parameter is attached.
Attribution parameter
atr=shopper-id-12345 (illustrative)This is the URL field that carries the cookie value on matching navigations.
03EvidenceNETWORK CAPTURE
Captured request
GEThttps://alphashopnow.co/?atr=shopper-id-12345
04EvidenceCODE COMPARE
The code that does this

Install handler reads the cookie and writes it into the navigation rule

What it actually does
Readable service worker logicdeobfuscated/js/service_worker.js
chrome.runtime.onInstalled.addListener(function (details) {
    chrome.cookies.get({url: "https://alphashopnow.co", name: "id"},function(id) {
        if (id) {
            cohort(id.value);
        }
    });
});

function cohort(id) {
    fetch(
        chrome.runtime.getURL('rules.json'))
        .then(r => {
            return r.json();
        })
        .then(j => {
            j.addRules[0].action.redirect.transform.queryTransform.addOrReplaceParams[0].value = encodeURIComponent(id);
            chrome.declarativeNetRequest.updateDynamicRules(j);
        });
}
Readable dynamic rule templatedeobfuscated/rules.json
{
  "addRules":[
    {
      "id": 1,
      "priority": 1,
      "condition": {
        "regexFilter": "^https://alphashopnow.co/",
        "resourceTypes": ["main_frame"]
      },
      "action": {
        "type": "redirect",
        "redirect": {
          "transform": {
            "queryTransform": {
              "addOrReplaceParams": [
                {"key": "atr", "value": ""}
              ]
            }
          }
        }
      }
    }
  ],
  "removeRuleIds": [1]
}
05EvidenceTHIRD PARTY LIST
External destination reached by the modified navigation
  • alphashopnow.co

    Receives matching main-frame navigations after the extension appends the cookie-derived atr query parameter.

Data recipients

alphashopnow.co
Updated 17 September 2026njdamnnkfdgeilhlfpgejdnkganhamei