Is TripChipper (TravelArrow) - Travel Better safe?

// Hardcoded Whimstay API endpoint and 25-year bearer token
const WHIMSTAY_ENDPOINT = 'https://apiprodv2.whimstay.com/whimstayAPI/v1/travel-arrow/pricing';
const WHIMSTAY_TOKEN = '<JWT: id=275422, scope=TRAVELLER, exp=2051-01-02>';
const CJ_AFFILIATE_BASE = 'https://www.anrdoezrs.net/click-100950458-17169403';

// For each Airbnb listing in search results:
async function checkWhimstayPrice(listing, searchContext) {
  const propertyId = extractPropertyId(listing); // from GraphQL relay ID
  const airbnbPrice = extractNightlyPrice(listing, searchContext.checkIn, searchContext.checkOut);

  const payload = {
    check_in: searchContext.checkIn,
    check_out: searchContext.checkOut,
    airbnb_property_id: propertyId,
    airbnb_pricing: airbnbPrice,
    no_of_adults: searchContext.adults,
    no_of_childs: searchContext.children,
    no_of_pets: searchContext.pets
  };

  const response = await fetch(WHIMSTAY_ENDPOINT, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${WHIMSTAY_TOKEN}`
    },
    body: JSON.stringify(payload)
  });

  const result = await response.json();
  // If Whimstay price is lower, wrap their URL in a CJ affiliate link
  if (result.whimstay_pricing < airbnbPrice) {
    return { ...result, whimstay_url: `${CJ_AFFILIATE_BASE}?sid=ta-airbnb&url=${encodeURIComponent(result.whimstay_url)}` };
  }
}

class HostedCheckoutTracker {
  static register() {
    if (this.registered) return;
    this.registered = true;
    this.refreshConfigCache();
    this.warmDomainsCache();
    this.warmHeuristicsCache();

    const filter = { urls: ["<all_urls>"], types: ["main_frame"] };

    chrome.webRequest.onBeforeRequest.addListener(details => {
      this.isEnabledSync() && this.handleBeforeRequest(details);
    }, filter);
    chrome.webRequest.onBeforeRedirect.addListener(details => {
      this.isEnabledSync() && this.handleBeforeRedirect(details);
    }, filter);
    chrome.webRequest.onCompleted.addListener(details => {
      this.isEnabledSync() && this.handleCompleted(details);
    }, filter);
    chrome.webRequest.onErrorOccurred.addListener(details => {
      this.isEnabledSync() && this.chains.delete(details.requestId);
    }, filter);

    log("[HostedCheckoutTracker] webRequest listeners registered");
  }
}

static async fireOffDomainDiscovery(match) {
  const dedupeKey = `${match.tabId}|${normalizeHostForDedupe(match.offHost)}|${match.matchedKeyword}`;
  const lastFired = this.recentDiscoveryKeys.get(dedupeKey);
  if (lastFired && Date.now() - lastFired < 30_000) return; // 30s de-dupe

  this.recentDiscoveryKeys.set(dedupeKey, Date.now());
  log(`[HostedCheckoutTracker] Discovery: ${match.merchantDomain} -> ${match.offHost}`);

  await createEvent({
    group: "cashback",
    type: "HostedCheckoutOffDomainDiscovered",
    service: match.merchantDomain,
    url: match.offUrl,
    important: true,
    meta: {
      merchantDomain: match.merchantDomain,
      fromUrl: match.merchantUrl,
      toUrl: match.offUrl,
      toHost: match.offHost,
      matchedKeyword: match.matchedKeyword,
      isKnownPaymentHost: match.isKnownPaymentHost
    }
  });
}

// createEvent() — base64-encodes the JSON and POSTs it as a single form field
async function createEvent(event) {
  const account = await getAccount();
  const payload = {
    ...event,
    accountId: account?.id ?? null,
    meta: { ...event.meta, version: chrome.runtime.getManifest().version, name: "chromeDesktop" }
  };
  const encoded = btoa(new TextEncoder().encode(JSON.stringify(payload))
    .reduce((s, b) => s + String.fromCodePoint(b), ""));
  await fetch(`${config.api.url}/v3/events`, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({ payload: encoded }),
    credentials: "omit"
  });
}