Is TripChipper (TravelArrow) - Travel Better safe?

// Hardcoded Whimstay API endpoint and 25-year bearer tokenconst WHIMSTAY_ENDPOINT = 'https://apiprodv2.whimstay.com/whimstayAPI/v1/travel-arrow/pricing';const WHIMSTAY_TOKEN = '<JWT: id=275422, scope=TRAVELLER, exp=2051-01-02>';const CJ_AFFILIATE_BASE = 'https://www.anrdoezrs.net/click-100950458-17169403';// For each Airbnb listing in search results:async function checkWhimstayPrice(listing, searchContext) {  const propertyId = extractPropertyId(listing); // from GraphQL relay ID  const airbnbPrice = extractNightlyPrice(listing, searchContext.checkIn, searchContext.checkOut);  const payload = {    check_in: searchContext.checkIn,    check_out: searchContext.checkOut,    airbnb_property_id: propertyId,    airbnb_pricing: airbnbPrice,    no_of_adults: searchContext.adults,    no_of_childs: searchContext.children,    no_of_pets: searchContext.pets  };  const response = await fetch(WHIMSTAY_ENDPOINT, {    method: 'POST',    headers: {      'Content-Type': 'application/json',      'Authorization': `Bearer ${WHIMSTAY_TOKEN}`    },    body: JSON.stringify(payload)  });  const result = await response.json();  // If Whimstay price is lower, wrap their URL in a CJ affiliate link  if (result.whimstay_pricing < airbnbPrice) {    return { ...result, whimstay_url: `${CJ_AFFILIATE_BASE}?sid=ta-airbnb&url=${encodeURIComponent(result.whimstay_url)}` };  }}

function findApiKey() {  const metaTags = document.querySelectorAll("meta");  for (const meta of metaTags) {    const content = meta.getAttribute("content") || "";    const name = (meta.getAttribute("name") || "").toLowerCase();    if (name.includes("api-key") || name.includes("apikey")) return content;  }  const inlineScripts = document.querySelectorAll("script:not([src])");  for (const script of inlineScripts) {    const match = (script.textContent || "").match(/"key"\s*:\s*"([a-z0-9]{20,})"/);    if (match) return match[1];  }  return "d306zoyjsyarp7ifhu67rjxn52tv0t20"; // hardcoded fallback key}

function fetchAdditionalPages(cursor, apiConfig) {  return __awaiter(this, void 0, void 0, function* () {    const searchParams = new URLSearchParams(window.location.search);    let nextCursor = cursor;    const collected = [];    const maxPages = getPageBudget(false); // 10 on first search, 6 on later ones    try {      for (let page = 0; page < maxPages && nextCursor && withinRateLimit(); page++) {        recordRequest();        const body = buildStaysSearchBody(nextCursor, searchParams);        const response = yield originalFetch(apiConfig.apiUrl, {          method: "POST",          headers: apiConfig.headers, // includes X-Airbnb-API-Key          body: JSON.stringify(body),          credentials: "same-origin" // your Airbnb session cookie rides along        });        if (!response.ok) break;        const json = yield response.json();        const results = json?.data?.presentation?.staysSearch?.results?.searchResults;        const paginationInfo = json?.data?.presentation?.staysSearch?.results?.paginationInfo;        if (Array.isArray(results) && results.length > 0) collected.push(...results);        if (page === 4) { postResultsToPage([...collected], false); collected.length = 0; }        nextCursor = paginationInfo?.nextPageCursor || null;        if (!nextCursor) {          const pageCursors = paginationInfo?.pageCursors;          if (Array.isArray(pageCursors)) {            for (let i = page + 2; i < pageCursors.length; i++) {              if (typeof pageCursors[i] === "string" && pageCursors[i].length > 0) {                nextCursor = pageCursors[i];                break;              }            }          }        }        if (!nextCursor) break;      }      collected.length > 0 ? postResultsToPage(collected, true) : postResultsToPage([], true);    } catch (e) {      postResultsToPage([], true);    }  });}

class HostedCheckoutTracker {  static register() {    if (this.registered) return;    this.registered = true;    this.refreshConfigCache();    this.warmDomainsCache();    this.warmHeuristicsCache();    const filter = { urls: ["<all_urls>"], types: ["main_frame"] };    chrome.webRequest.onBeforeRequest.addListener(details => {      this.isEnabledSync() && this.handleBeforeRequest(details);    }, filter);    chrome.webRequest.onBeforeRedirect.addListener(details => {      this.isEnabledSync() && this.handleBeforeRedirect(details);    }, filter);    chrome.webRequest.onCompleted.addListener(details => {      this.isEnabledSync() && this.handleCompleted(details);    }, filter);    chrome.webRequest.onErrorOccurred.addListener(details => {      this.isEnabledSync() && this.chains.delete(details.requestId);    }, filter);    log("[HostedCheckoutTracker] webRequest listeners registered");  }}

static async fireOffDomainDiscovery(match) {  const dedupeKey = `${match.tabId}|${normalizeHostForDedupe(match.offHost)}|${match.matchedKeyword}`;  const lastFired = this.recentDiscoveryKeys.get(dedupeKey);  if (lastFired && Date.now() - lastFired < 30_000) return; // 30s de-dupe  this.recentDiscoveryKeys.set(dedupeKey, Date.now());  log(`[HostedCheckoutTracker] Discovery: ${match.merchantDomain} -> ${match.offHost}`);  await createEvent({    group: "cashback",    type: "HostedCheckoutOffDomainDiscovered",    service: match.merchantDomain,    url: match.offUrl,    important: true,    meta: {      merchantDomain: match.merchantDomain,      fromUrl: match.merchantUrl,      toUrl: match.offUrl,      toHost: match.offHost,      matchedKeyword: match.matchedKeyword,      isKnownPaymentHost: match.isKnownPaymentHost    }  });}// createEvent() — base64-encodes the JSON and POSTs it as a single form fieldasync function createEvent(event) {  const account = await getAccount();  const payload = {    ...event,    accountId: account?.id ?? null,    meta: { ...event.meta, version: chrome.runtime.getManifest().version, name: "chromeDesktop" }  };  const encoded = btoa(new TextEncoder().encode(JSON.stringify(payload))    .reduce((s, b) => s + String.fromCodePoint(b), ""));  await fetch(`${config.api.url}/v3/events`, {    method: "POST",    headers: { "Content-Type": "application/x-www-form-urlencoded" },    body: new URLSearchParams({ payload: encoded }),    credentials: "omit"  });}