Is Pie Shopping: AI Cash Back and Coupons safe?
We analyzed Pie Shopping: AI Cash Back and Coupons version 1.33.6's actual code and gave it a 28/100 trust score. This extension offers shopping features…
Bottom line
This extension offers shopping features but combines unusually broad surveillance and page-control powers with remote code execution attempts.
What it can access
It can operate on every website, observe browsing and search activity, and use cookies, traffic controls, and extension management; this exceeds typical coupon needs.[Q1][Q4][Q12][Q17]
Security weaknesses
Remote services can direct page actions, and downloaded third-party text is passed to code evaluation, creating a serious remote-control weakness.[Q7][Q11][Q16]
Signs of misuse
The package sends browsing, search, device, and usage information to its services while changing offers, referrals, search results, and traffic for monetization.[Q6][Q12][Q13][Q17]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests every-site access plus cookies, tabs, scripting, navigation, request monitoring, traffic blocking, installed-extension management, side panels, offscreen documents, and unlimited storage. This is exceptionally broad even for cashback and coupon automation.
Grants host access to <all_urls>. — manifest.json:9-11
Runs a content script in every frame at document_start on every URL. — manifest.json:17-27
Declares cookies, tabs, scripting, webNavigation, unlimitedStorage, DNR, webRequest, management, offscreen, and sidePanel permissions. — manifest.json:76-90
Which websites can it run on, and can it read or change what appears on those pages?
It inserts shopping, coupon, rewards, ad-block, and AI interfaces and automates merchant pages. Remotely supplied placement actions can click arbitrary selectors, dispatch input-related events, and set or remove arbitrary attributes.
runSiteActions implements triggerFocus, click, setAttr, removeAttr, reloadPage, waits, and prompt/alert suppression for actions attached to supplied placements. — placements.js:2
Locates coupon inputs and apply controls to automate coupon testing on Amazon. — contentAmazonCoupons.js:2
Automatically injects Amazon and Google shopping/search scripts in addition to the all-site starter. — manifest.json:28-65
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Remote placement rules can select page elements and inspect text, properties, and attributes for matching. Merchant automation also reads prices, product details, and coupon/form state; no general password-reading routine was found.
PlacementsEvaluator resolves server-provided selectors and elementValue definitions for properties, attributes, and text, then evaluates supplied Mingo conditions. — placements.js:2
Reads Amazon product identifiers, prices, and page state to calculate and display rewards. — contentAmazonProductRewards.js:2
Reads coupon form and result state while applying codes. — contentAmazonCoupons.js:2
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It observes tab URLs, titles, navigation completion, referrers, and page changes across the web and uses those signals for merchant sessions, offers, analytics, and its intent-engine history database.
Reports location.href and document.title on page start and SPA URL changes. — contentScriptStarted.js:1
Handles tab updates and navigation events, merchant sessions, current-tab state, and intent-engine visits. — background.js:2
Requests tabs and webNavigation permissions. — manifest.json:76-89
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares unlimitedStorage and offscreen but no clipboard, capture, downloads, or filesystem permission. — manifest.json:76-90
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends persistent IDs, device/browser metadata, feature usage, merchant and affiliate events, offer/audience data, current search queries, and user-provided AI chat context to Pie services. Raw full browsing history and raw cookie values were not found leaving the device.
createUserManager posts the persistent anonymous ID to pie.org and GraphQL managers exchange account, offer, audience, merchant, and rewards data. — background.js.map:1
Segment analytics targets s.pie.org and attaches persistent anonymous/user/device identifiers, client metadata, and event properties. — background.js:2
The AI shopping panel communicates with chat.pie.org and sends chat/page context when the feature is used. — shoppingAgent.js:2
Does it download or run code, settings, or instructions supplied by a remote server?
Pie supplies feature flags, merchants, search providers, audience rules, offers, standdown rules, placements, selectors, matching expressions, and page actions. A third-party server also supplies Lottie animation data that can reach eval().
Intent-engine API code fetches active placements, search-provider changes, session configuration, audiences, and offers from Pie GraphQL. — background.js.map:1
Downloads standdown-domain rules from cdn.pie.org and regularly syncs feature/configuration data. — background.js:2
Fetches three JSON animations from cdn.lottielab.com and passes their data to a renderer with expressions enabled by default. — shopping.js:2
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Significant behavior runs automatically: all-page URL/title and engagement reporting, history/session storage, audience evaluation, analytics, configuration sync, request monitoring, ad blocking, merchant detection, and offer checks.
Loads the all-page observer at document_start in every frame. — manifest.json:17-27
Immediately reports page details and installs click, scroll, history, and inactivity listeners. — contentScriptStarted.js:1
Starts intent-engine, analytics, standdown, navigation, ad-blocking, and periodic synchronization managers in the service worker. — background.js:2
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, search, privacy, or browserSettings permission. — manifest.json:76-90
Browser-wide changes found were DNR ad/traffic rules and management.setEnabled for selected extensions, not browser preference APIs. — background.js:2
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The package is nearly 20 MB unpacked and dominated by single-line minified bundles, embedded ad-block resources, and remote configuration. Much is recognizable Webpack/library code and one source map exposes key first-party modules, but a complete audit is difficult.
Lists multiple 0.6-2.4 MB minified JavaScript bundles and a roughly 19.9 MB unpacked package. — inventory.json:1
Includes source content for eight first-party background modules, improving reviewability of some sensitive paths. — background.js.map:1
Most remaining first-party and library logic is concatenated and minified onto one line. — background.js:2
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
The Lottie expression engine calls eval() on expression text from animation data, and Pie fetches remote animation JSON for that renderer. The Twitch blocker also evaluates fetched Twitch worker source.
Builds expression_function with eval() from the animation expression value and defaults runExpressions to true. — shopping.js:2
Fetches JSON from three cdn.lottielab.com URLs and supplies it as animation data without disabling expressions. — shopping.js:2
Synchronously reads a Twitch worker URL as text, injects ad-block hooks, and calls eval(workerString) inside a replacement blob worker. — assets/scripts/twitch-vaft-userscript-v2.js:1
Does it track the websites, pages, searches, or links you visit?
It tracks visited top-level URLs, titles, searches, clicks/scroll engagement, and time spent across the web. The detailed log is encrypted locally, but Pie-defined audience matches and current search queries can be sent to Pie.
Reports every page URL/title plus engagement and timeout events from all sites. — contentScriptStarted.js:1
Stores normalized pages, searches, and session durations in an AES-CTR RxDB intent-engine database and evaluates remote audience definitions. — background.js:2
Includes user audience IDs and the current search query in intent-engine offer requests; raw complete history was not found in those requests. — background.js:2
Does it create a persistent ID or browser fingerprint to recognize you?
It creates persistent anonymous and device IDs, syncs the anonymous ID across browser profiles, links it to a Pie cookie/account when available, and sends analytics with browser, OS, locale, timezone, user-agent, extension, and event context.
createUserManager reads or creates anonymousId, stores it in sync and local storage, reconciles it with a Pie cookie, and POSTs it to pie.org/ext/enabled. — background.js.map:1
Analytics context includes anonymousId/userId, persistent device ID, extension version, locale, OS, timezone, browser details, and full user agent. — background.js:2
Does it send cookies, session details, authentication data, or page contents elsewhere?
It reads and writes Pie login/identity cookies and captures selected response Set-Cookie headers for remotely matched cashback standdown domains. The Twitch blocker captures Twitch authorization and integrity headers for replacement Twitch requests.
User management reads Pie anonymous, login-state, and login-timestamp cookies and uses authenticated GraphQL requests. — background.js.map:1
onHeadersReceived examines all main-frame response headers and retains Set-Cookie headers when remote standdown rules match, so affiliate cookies can be removed or restored. — background.js:2
Hooks Twitch fetch calls to capture Authorization, Client-Integrity, Client-Version, Client-Session, and device headers for its own Twitch GQL/player requests. — assets/scripts/twitch-vaft-userscript-v2.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No general keylogger, screen/audio recorder, or password-field collector was found. Coupon automation fills promo-code inputs and remote placement actions can dispatch input and keyboard events to selected elements, but the package did not contain a routine that captures arbitrary typed text.
Programmatically enters coupon codes and clicks apply controls as an advertised feature. — contentAmazonCoupons.js:2
Remote triggerFocus actions can dispatch focus, change, input, keyup, keydown, and keypress events to a selected element. — placements.js:2
Requests no tabCapture, desktopCapture, or audioCapture-style permission. — manifest.json:76-90
Can a website or remote server send commands that make the extension take actions?
Pie remotely controls feature flags, audiences, offers, site matches, page selectors, and action lists. Those actions can click, reload, set/remove attributes, dispatch input events, and suppress dialogs on matched sites.
fetchPlacements retrieves placementHash, hostname, and match payloads from Pie's GraphQL service. — background.js.map:1
Receives placements from the background, evaluates their remote DOM matches, extracts unique actions, and runs them serially. — placements.js:2
Action registry includes triggerFocus, removeAttr, click, reloadPage, setAttr, wait, waitForChange, and alert/confirm/prompt suppression. — placements.js:2
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It blocks ads and trackers, inserts offers and sponsored shopping content, boosts partner results, redirects through Pie affiliate URLs, manages cashback cookies, and detects or can disable competing ad blockers. These are core monetization features but materially change pages and traffic.
Uses declarativeNetRequest and webRequest for ad blocking, standdown detection, affiliate tagging, redirect management, and cookie handling. — background.js:2
Adds or changes Google result presentation for partner/cashback offers. — contentSERPPartnerBoost.js:2
Inventories extensions and can call management.setEnabled(false) for configured additional ad blockers. — background.js:2
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It blocks and redirects requests, watches navigation, inspects all main-frame response headers, manages affiliate tags/cookies, and proxies selected Twitch requests for ad blocking.
Requests webNavigation, declarativeNetRequestWithHostAccess, declarativeNetRequestFeedback, and webRequest. — manifest.json:76-89
Registers onHeadersReceived with extraHeaders on all main-frame URLs and maintains dynamic DNR/ad-block rules. — background.js:2
Hooks page and worker fetch calls to alter Twitch player and playlist traffic. — assets/scripts/twitch-vaft-userscript-v2.js:1
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Declares no nativeMessaging permission and no localhost- or file-specific permission beyond broad web host access. — manifest.json:76-90
Native messaging in createUserManager is guarded by a build-time APP_ID; this manifest does not authorize that path. — background.js.map:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
Remote Lottie JSON expression text can reach eval(), and fetched Twitch worker source is evaluated inside an injected worker wrapper. Manifest V3 CSP may prevent the calls, but the extension attempts to convert remote text into executable code.
Fetches third-party Lottie JSON, keeps expressions enabled by default, and compiles data.x expression values with eval(). — shopping.js:2
Reads the intercepted Twitch worker source as responseText and evaluates it after adding hooks. — assets/scripts/twitch-vaft-userscript-v2.js:1
Defines no relaxed content_security_policy, so Chrome's default MV3 CSP is an important untested mitigating factor. — manifest.json:1-125
Can ordinary websites access privileged extension features through messaging or exposed files?
Pie websites and one companion extension can invoke privileged external-message handlers for affiliate activation, chat settings, intent-engine testing/clearing/sync, and installed-extension/ad-block management. Manifest allowlisting limits the senders, but the handlers trust that boundary.
Allows external messaging from pie.org, www.pie.org, campaign-dash.pie.org, and one fixed extension ID. — manifest.json:91-101
External dispatcher exposes merchant affiliate actions, chat settings, intent-engine operations, and extensions-management handlers. — background.js:2
Merchant rewards manager accepts externalActivateRewards and external affiliate-tagging parameters from an allowed sender. — background.js.map:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior changes by remote feature flags, merchant/domain rules, user audience membership, current search, installed extensions, account state, and server-selected campaigns. This supports product targeting but makes the installed package alone insufficient to predict what a user will see.
Remote feature flags gate the intent engine and other modules; the local secureSelf setting defaults enabled when unset. — background.js:2
Remote audiences are evaluated against local browsing/search/session and extension metadata, then used to select offers. — background.js:2
Only remotely supplied hostname/path/DOM matches activate their corresponding actions. — placements.js:2
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Records contentScriptStarted.js at about 215 KB and many feature bundles between roughly 0.6 and 2.4 MB. — inventory.json:1
Runs the starter in all frames at document_start on all URLs. — manifest.json:17-27
Maintains RxDB history/search/session collections, 30-second engagement updates, alarms, periodic synchronization, and audience evaluation. — background.js:2
Does it change form fields or where a form sends its information?
Coupon automation intentionally fills promo inputs, while remote placement actions can target any selector, set any attribute name/value, click controls, and dispatch input/keyboard events. Nothing restricts setAttr from changing a form action or another security-sensitive attribute.
setAttr applies server-supplied selector, attrName, and attrValue with jQuery; no attribute allowlist is present. — placements.js:2
triggerFocus dispatches focus/change/input/keyup/keydown/keypress and click invokes the selected element's click method. — placements.js:2
Fills and submits coupon-code fields as advertised shopping behavior. — contentAmazonCoupons.js:2