Is AmazingHiring safe?
AH is medium risk. The extension's content script runs on every website. About 10% of the time you visit a page unrelated to recruiting, it sends that page's domain and full URL to AmazingHiring's analytics server, whether or not you are signed in.
Who publishes itAmazing Hiring, Inc. - no other listings under this identity, 2 shared hostnames
Amazing Hiring, Inc. - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Every install reports a 10% sample of unrelated page visits to AmazingHiring
The extension's content script runs on every website.
About 10% of the time you visit a page unrelated to recruiting, it sends that page's domain and full URL to AmazingHiring's analytics server, whether or not you are signed in.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You browse to a page that isn't one of the extension's supported recruiting or profile sites, for example an online store or a news article.
About 10% of the time, the extension sends that page's domain and full URL to AmazingHiring's own analytics endpoint.
This fires on ordinary browsing, unrelated to any recruiting feature you're using, and does not require you to be signed in.
HTTP 200 {} observed during dynamic analysis. The navigated-to URL was used as the canary and was found verbatim in this outbound body.
- Content-Type
- application/json; charset=UTF-8
{ "payload": { "user_id": null, "event_type": "Visit Unknown Page With Extension", "event_properties": { "Ext_Page_Domain": "amazon", "Ext_Page_Url": "https://www.amazon.com/gp/cart/view.html" } }}- Full page URLhttps://www.amazon.com/gp/cart/view.html
The complete address of the page you were on, including its path and query string.
- Page domainamazon
The bare domain of the page you were on, sent alongside the full URL.
- Event typeVisit Unknown Page With Extension
A fixed label marking this as an off-site page visit rather than something you did inside the extension.
- Account IDnull
Your AmazingHiring account ID, included when you're signed in; observed as null when signed out.
The sampling check in content.js and the event send in background.js
Sampling gate: current URL c passes a 10% random check
deobfuscated/js/content.js:56004-56009c && Math.random() < .1 && (i = Xo(c), o = c, function(e) { $c(e)("Visit Unknown Page With Extension", { Ext_Page_Domain: i, Ext_Page_Url: o })})(t)Endpoint host defaults to search.amazinghiring.com
deobfuscated/js/background.js:24333-24341var x = "https://search.amazinghiring.com", E = x;function A() { return E}function k(t) { E = t || x}Background handler POSTs the event to /api/events/
deobfuscated/js/background.js:24896-24913kt && fetch(`${t}/api/events/`, { method: "POST", headers: { "X-EVENT-SERVICE-TOKEN": kt, "Content-Type": "application/json; charset=UTF-8" }, body: JSON.stringify({ payload: { user_id: a, licence_id: (0, r.get)(e, "licenceId"), event_type: n, time: Date.now(), event_properties: Et(Et({}, i), {}, { Event_Name: n }) } })})- search.amazinghiring.com
AmazingHiring's own analytics backend. Receives the domain and full URL of about 10% of the non-recruiting pages you visit while the extension is installed.