Is AMZ Suggestion Expander safe?

Question

Accepted Answer

AMZ Suggestion Expander is rated clean, though our review noted the following. AMZ Suggestion Expander asks you to enter your first name, last name, and email address on its own built-in setup page. When you submit that form, the extension sends the data directly to Mailchimp's mailing-list API using an API key that is hardcoded in plain text inside the extension's own JavaScript file — the same key ships identically in every copy of the extension downloaded from the Chrome Web Store, so anyone who unpacks the package can read it. A follow-up check found the exact key no longer authenticates against Mailchimp, which suggests it has since been rotated or revoked, but that doesn't change the underlying issue: a third-party API credential was shipped in the extension's client-side source, extractable without any decoding or user interaction.

Is AMZ Suggestion Expander safe?

Findings