Is Amazon Order History Reporter safe?

Medium risk

Amazon Order History Reporter transmits an RSA-encrypted user email and order metadata to the developer's server on each order history scrape.

Each time the extension displays an order, transaction, or shipment table, it sends a HEAD request to azad-extension.co.uk/logs/ carrying the user's ExtensionPay account email (encrypted with a hardcoded 3072-bit RSA public key), the table type, the row count, and a status flag. This allows the developer to track when each user scrapes their Amazon order history and how many orders their account contains. No order item details are transmitted, but the combination of encrypted identifier and row count links scrape activity to individual accounts.

philipv1.16.24Chrome Web Store
49Risk
Who publishes it

philip - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
philip
Website
github.com/philipmulcahy/azad

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

ExtensionPay email RSA-encrypted and sent to developer server on each scrape

Viewing your Amazon order history reads the email tied to its paid plan, encrypts it with a fixed RSA key they control, and sends it to the developer's server, azad-extension.co.uk.

Captured in traffic; the server gets a stable ID.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open your Amazon order history page and the extension displays the scraped table.

The extension did this

The background service worker reads your ExtensionPay email address, encrypts it with a fixed RSA public key, and sends it to azad-extension.co.uk.

The request fires on both the orders table render path and the transactions table render path.

Captured request
GEThttps://azad-extension.co.uk/logs/?client=Azad%20UI&operation=display.orders&rowCount=15&status=complete&userid=<redacted>

HTTP 200. Six such HEAD requests captured in dynamic analysis session.

Fields sent in every logging request
  • Your account email (encrypted)
    Uv8Kz3mQ...base64url ciphertext

    The email tied to your paid subscription, encrypted with the developer's public key. The developer holds the private key and can decrypt it.

  • Table operation type
    display.orders

    Which view you used, orders, items, shipments, or transactions.

  • Row count
    15

    The number of rows in your order table, a proxy for how many Amazon orders are in your history.

  • Client identifier
    Azad UI

    Identifies the UI surface that triggered the request.

The code that does this

RSA encryption of account email, crypto.ts

Readable version
// background.bundle.js lines 189870-189888 (./src/js/crypto.ts)const publicKey = forge.pki.publicKeyFromPem(`-----BEGIN RSA PUBLIC KEY-----MIIBigKCAYEAl4+VzBJsn39ykBv+DoPiMP9VU+eTSG+PU7e3vB6LXtOSr1XxoT3ls0+LuGa65jXe6PV/q0pJzC2mCIDsXEzjx1sf6mbwepJuHyyygnULy0N2UsfwwOyEIozuycdtZEdVXMio6KEheBtQ7ZP6OifIOtrYH7N/vzJfnxAxHJIo63AcgjghbABmseTPBL2i74q4myUn4kO44ayJF9oehi6Dz/pUqLALqVcf2ETI0VvhBFTUBjU9or34KxARNj9pkTvCRl1fe02BKVTuAqoA4EzjPe+1lRioAb+5POM/TUDxoZhIhRtI9a7nlBgeVOGJe38B8cVmEV2a3WD3KLsvt740eFD3lcxccJVMNuS11/oOLplxBbG9/CU34MzoTjoOGF+RLTY89MMbSGGQRyNntQIcT5z0DkC8ghl1loDkt3qdGbWwYIfe56fN1HfibZHdPxERb5NWMyZE8HsKYspfkDgUB0mP0YHttOk09ox6XQQNNL1Q2fAlDREB6eDC3LmT+1ztAgMBAAE=-----END RSA PUBLIC KEY-----`);function encrypt(text) {    const encrypted = publicKey.encrypt(text, 'RSAES-PKCS1-V1_5');    const encrypted64 = forge.util.encode64(encrypted);    const urlsafe = urlsafeBase64.encode(Buffer.from(encrypted64, 'utf-8'));    return urlsafe;}
Data destination
    • azad-extension.co.uk

    Developer-operated logging server. Receives encrypted account email plus usage metadata on every order table render. Listed in manifest.json host_permissions and connect-src CSP.

Amazon order count and scrape type sent to developer server on each use

Viewing order history sends the developer's server your order table's row count, the data type scraped (orders, transactions, shipments), and a completion status, alongside an encrypted copy of your email.

Confirmed by traffic capture.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You finish viewing your Amazon orders, items, shipments, or transactions table.

The extension did this

The extension sends a log record to the developer's server containing the number of rows displayed and which type of data you scraped.

This fires on both the orders/items/shipments render path and the separate transactions render path.

Captured request
GEThttps://azad-extension.co.uk/logs/?client=Azad%20UI&operation=display.orders&rowCount=15&status=complete&userid=<redacted>

HTTP 200. Six HEAD requests with this structure captured in dynamic analysis. rowCount=15 reflects the number of order rows rendered in the test session.

Usage metadata fields transmitted per scrape
  • Scrape type
    display.orders

    Identifies which Amazon data category you accessed, orders, items, shipments, or transactions.

  • Order row count
    15

    The number of rows in your rendered table, which approximates the total number of orders or transactions in your Amazon account history.

  • Completion status
    complete

    Reports that the scrape finished successfully.

  • Client surface
    Azad UI

    Identifies the UI component that triggered the log.

The code that does this

Log message assembly in inject.bundle.js after orders table render

Readable version
// inject.bundle.js lines 214246-214254 (./src/js/amazon_order_history_table.ts)// Called after orders/items/shipments table is rendered:(await getBackgroundPort())?.postMessage({    action: 'remote_log_with_user_id',    log_msg: {        operation: `display.${tableType}`,  // e.g. 'display.orders'        status: 'complete',        rowCount: (table.rows.length).toString(),  // number of rows rendered        client,  // e.g. 'Azad UI'    },});// Lines 214285-214293 — identical pattern for transactions table
Data destination
    • azad-extension.co.uk

    Developer-run logging server. Gets scrape-type and row-count metadata on every table render, plus an encrypted email copy. Listed in manifest host_permissions and connect-src CSP.

Where it sends data

Destinations our analysis observed Amazon Order History Reporter contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • azad-extension.co.uk

    Amazon Order History Reporter sends data to azad-extension.co.uk. No other extension we have analysed sends data here.

Updated 30 September 2026mgkilgclilajckgnedgjgnfdokkgnibi