JSON Formatter

Daksh Khurana2026年5月2日

★★★★★1

Dontation popups on cart pages, scammy

Ákos Schneemaier2026年4月28日

★★★★★1

Deleted as it begs for money.

Matthew Oles2026年4月28日

★★★★★1

Hijacks shopping cart pages to beg for donations. Insane that anyone thought that was appropriate. Shameful behavior.

Jan Brodda2026年4月28日

★★★★★1

Zeigt seit dem neusten Update Werbung - keine Empfehlung mehr!

Tyler Corley2026年4月27日

★★★★★1

Yeah - so a JSON formatting extension should _probably_ not be doing anything BUT JSON formatting... yet here we are.

Lewis Eason2026年4月26日

★★★★★1

This extension now looks at sites you visit and injects a scammy donation popup into the page. Sketchy af.

David Felix2026年4月26日

★★★★★1

Malware.

Robert Gres2026年4月24日

★★★★★1

Removing because it injects some shady code to all websites I visit

Nick Barone2026年4月24日

★★★★★1

Recently started hijacking checkout flows of all websites to inject their donation scheme. Absolutely unacceptable behavior out of an extension thats only purpose should be to format json.

Muhammad Awais2026年4月23日

★★★★★1

Report Reason: Malware / Malicious Behavior (Bait-and-Switch, Affiliate Hijacking, Spyware) Description: This extension claims to be a simple "JSON Formatter," but the source code reveals it is a trojan containing a massive, hidden affiliate marketing and tracking payload masquerading as a service called "GiveFreely." It abuses the <all_urls> permission to hijack browser requests and track users without consent. Proof of Malicious Behavior found in the source code: Affiliate Link Hijacking: The background worker (worker/worker.js) intercepts web requests to automatically route shopping sessions through affiliate networks (specifically wild.link) to generate unauthorized commissions. Proof: worker.js contains active logic searching for store identifiers, including explicit code to scrape Shopify Store IDs (window.ShopifyAnalytics.lib.trekkie.defaultAttributes.shopId) and intercept checkout pages (keywords: cart, checkout, shopping-bag). Google Search Results (SERP) Manipulation: The content script (content/core.js) actively monitors and injects elements into Google Search results to redirect clicks to affiliate URLs. Proof: content/core.js uses the regex /^https?:\/\/(?:www\.)?google\.[a-z]{2,}(\.[a-z]{2})?\/search\?(?:.*&)?q=[^&]+(?:&.*)?$/ alongside DOM selectors like .yuRUbf a, .MjjYud a to parse and alter Google Search output. Invasive Telemetry and Geolocation Tracking: The extension silently logs browsing habits and sends them to a remote server. It also pings a third-party service to determine the user's exact geolocation without asking for permission. Proof: The code makes unauthorized background fetch() requests to https://geoip.maxmind.com/geoip/v2.1/country/me to profile the user, and sends tracked events (e.g., CHECKOUT-POPUP-SHOWN, CHECKOUT-MERCHANT-IN-RESULTS-FOUND) to cdn.givefreely.com/data/behavioral/.