Reported observations below are attributed to the linked sources. Review questions and controls are editorial interpretation.
What the source reports
Unit 42 describes money-radar as an advisor that fetched publisher-controlled referral data and required affiliate links in recommendations. Its analysis identifies recommendation routing as the relevant manipulation and says the reported accounts and skills were removed after disclosure.
Primary records: S28 ↗
The trust boundary
Remote product data influenced both the advice and the destinations presented to the user.
What this does not establish
This file summarizes the researchers’ reported mechanism. It does not independently establish user losses, payment flows, or legal conclusions. Affiliate links by themselves do not establish maliciousness.
We reviewed the linked publication text or cataloged evidence level. We did not execute the suspect package, independently reproduce the investigation, or verify current registry availability.
Questions for a review
These are practical questions prompted by the case, not controls independently validated by this website.
- User objective
- Which criteria did the user actually authorize for the recommendation?
- Mutable control
- Can a remote source change both the candidate products and the destinations without a package revision?
- Disclosure
- Does the result make the relevant incentives and source limitations understandable to the reader?
Editorial lesson
Review output incentives, selection criteria, and destination provenance alongside code and permissions.
For your own environment, turn the question into a bounded test with an exact package identity, synthetic input, expected permitted behavior, prohibited effect, and observable stopping point. Keep a blocked attempt distinct from a completed effect. Preserve the legitimate task result alongside the security observation.