Is Amazon Keyword for Seller safe?

Medium risk

Amazon Keyword for Seller fetches server-chosen URLs from your browser and sends Seller Central brand reports to its servers.

On startup the extension opens a WebSocket to internal.sellerapp.com, sending your IP address and country, and then fetches whatever URLs the server requests using your browser, returning the parsed page data. Once a month it also uses your logged-in Amazon Seller Central session to download Brand Analytics Query Performance reports for your brands and posts them to api.sellerapp.com. Neither behavior is surfaced in the keyword tool's interface.

remixv1.0.0Chrome Web Store
55Risk
Who publishes it

remix - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
remix

Same store account

2 other listings published from this account, 1k+ users between them, none of them carrying a finding.

Smart SEO1k+LowPage Images Download13Clean

Shared hosts - 4 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

2.rome.api.flipkart.com
Also called by 2 other listings: Amazon Keyword Tool for free : SellerApp, Flipkart Seller Keyword-Listing Tool Datavio
completion.amazon.com.mx
Also called by 2 other listings, including 词匠-AMZ海量关键词运营
api.sellerapp.com
Also called by 4 other listings, including Amazon Keyword Tool for free : SellerApp, SellerApp Chrome Extension, Amazon Review Request Tool
dashboard.sellerapp.com
Also called by 8 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Keyword tool opens a sellerapp.com socket and fetches URLs the server names

Code analysis shows the service worker opens a WebSocket to sellerapp.com on startup and fetches server-chosen URLs from your browser, returning parsed pages.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

The extension's background worker starts after install or browser launch.

The extension did this

It opens a WebSocket to internal.sellerapp.com and waits for URLs to fetch.

The code that does this

Socket connect URL and job handler

Readable version

Fetch helper used for server-supplied URLs

src/pages/background/index.js
const uE = async e => {  try { return await (await fetch(e, {method: "GET", mode: "cors"})).text() }  catch (t) { return await (t == null ? void 0 : t.text()) || "" }}
Values placed in the socket connect URL
  • Socket ID
    id=3f9a1c52-7d0e-4b8a-9e21-5c6d8a0b1f47

    A persistent random ID that identifies this install to the server.

  • IP address
    ip_address=203.0.113.24 (illustrative)

    The public IP address returned by lumtest.com.

  • Country
    geo=US

    The country code returned by the same lookup.

Hosts contacted
    • internal.sellerapp.com

    Receives the socket connection and sends URLs to fetch.

    • lumtest.com

    Returns the device public IP and country.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Keyword tool sends Seller Central Brand Analytics reports to sellerapp.com

Code analysis shows the service worker uses a logged-in Seller Central session to request brand reports and send them to api.sellerapp.com.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

The background worker starts while the browser holds a Seller Central login.

The extension did this

It requests Brand Analytics reports for each brand and posts them to api.sellerapp.com.

The code that does this

Report fetch and upload

Readable version

Report request body

src/pages/background/index.js
await wr.post(u, {  viewId: "query-performance-brands-view",  filterSelections: [{id: "brand", value: e}, {id: "reporting-range", value: "monthly"}, {id: "monthly-year", value: "2024"}, {id: "2024-month", value: "2024-04-30"}],  selectedCountries: [t],  reportId: "query-performance-brand-report-table",  reportOperations: [{reportType: "TABLE", pageNumber: o, pageSize: 100, sortByColumnId: "qp-query-rank", ascending: !0}]})
Fields posted to api.sellerapp.com
  • Brand name
    Acme Outdoors (illustrative)

    The display name of a brand in the seller's account.

  • Brand code
    brand_code: ENT-48213 (illustrative)

    The Seller Central identifier for that brand.

  • Report month
    2024-04-30

    The month the report covers.

  • Marketplace
    ATVPDKIKX0DER (illustrative)

    The Amazon marketplace the report came from.

  • Report data
    reportsV2[0] rows, 100 per page

    Paged query performance rows returned by Seller Central.

Where the data goes
    • api.sellerapp.com

    Receives the brand report via /sellmetricsv2/market_basket_report.

    • sellercentral.amazon.com

    Source of the Brand Analytics reports, read with the signed-in session.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Amazon Keyword for Seller contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.sellerapp.com

    Amazon Keyword for Seller sends data to api.sellerapp.com. 2 other extensions we have analysed send data here.

  • internal.sellerapp.com

    Amazon Keyword for Seller sends data to internal.sellerapp.com. No other extension we have analysed sends data here.

Updated 15 October 2026oaibkhoajhogebhpnidaoalpnpbadcmd