Is The Optimiser - TradingView Strategies safe?

Medium risk

The Optimiser asks a publisher-controlled endpoint for URLs and can open them in browser tabs each day.

The extension runs a daily alarm that sends a POST request to sendtodiscord.davidd.tech/message, reads the returned message field as a URL, and opens it in a new tab when it changes. It also injects referral codes into signup forms on Bybit, Bitget, OKX, and KuCoin and makes those fields read-only after filling them.

ChromeExtGuyv1.76Chrome Web Store
45Risk
Who publishes it

ChromeExtGuy - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ChromeExtGuy
Website
groups.google.com/g/dat-chrome-ext

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Daily Alarm Lets Publisher Server Open Any Tab

The Optimiser arms a daily background alarm at install.

Each time it fires, it asks the developer's server for a URL and opens it as a new tab, no click needed.

A live test confirmed the server's page opened immediately.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

The extension installs itself and arms a recurring 24-hour background alarm, with no user interaction.

chrome.alarms.create('checkUpdates', { periodInMinutes: 1440 }) runs on install whenever no cached URL is stored yet.

The extension did this

Each time the alarm fires, the extension asks the developer's server for a URL and opens it as a new browser tab automatically.

No click, keystroke, or other user action precedes the tab opening.

Captured request
POSThttps://sendtodiscord.davidd.tech/message

HTTP 200, JSON body: {"message":"https://daviddtech.com/bots-incubation/"}

The code that does this

The alarm handler and update check, from the extension's shipping source.

Readable version

The update check

async function checkForUpdates() {	fetch("https://sendtodiscord.davidd.tech/message", { method: "POST" })		.then((e) => e.json())		.then(async (e) => {			let t = e.message;			t !== (await storageGetKey("lastUrl")) && chrome.tabs.create({ url: t }), await storageSetKeys("lastUrl", t);		})		.catch((e) => console.error(e));}

The alarm setup and dispatch

null === (await storageGetKey("lastUrl")) && chrome.alarms.create("checkUpdates", { periodInMinutes: 1440 });chrome.alarms.onAlarm.addListener(async (e) => {	"checkUpdates" === e.name && (await checkForUpdates());});
When this fires

Every 1 day

Once armed at install, the checkUpdates alarm fires every 24 hours independent of any user activity, re-querying the server and re-evaluating whether to open a new tab.

Where the tab-open instruction comes from
    • sendtodiscord.davidd.tech

    Developer-operated endpoint. Its response body's message field determines which URL opens automatically as a new tab on every installed copy of the extension, once per day.

Where it sends data

Destinations our analysis observed The Optimiser - TradingView Strategies contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • bitget.com

    The Optimiser - TradingView Strategies sends data to bitget.com. One other extension we have analysed sends data here.

  • bybit.com

    The Optimiser - TradingView Strategies sends data to bybit.com. One other extension we have analysed sends data here.

  • kucoin.com

    The Optimiser - TradingView Strategies sends data to kucoin.com. No other extension we have analysed sends data here.

  • okx.com

    The Optimiser - TradingView Strategies sends data to okx.com. No other extension we have analysed sends data here.

  • sendtodiscord.davidd.tech

    The Optimiser - TradingView Strategies sends data to sendtodiscord.davidd.tech. No other extension we have analysed sends data here.

Updated 30 September 2026emcpjechgmpcnjphefjekmdlaljbiegp