Is SellerAider Toolkit safe?
SellerAider Toolkit sends Depop page URLs, page HTML, and usage/error telemetry to Discord and SellerAider endpoints.
On Depop pages, the content script reports events such as JWT use, permission choices, relist or refresh errors, usernames, current URLs, and product metadata to hardcoded Discord webhooks. When automation errors occur, it can also send the current Depop URL and page HTML, including form-related page content, to app.selleraider.com error-reporting endpoints.
Who publishes itselleraider.com - no other listings under this identity, 4 shared hostnames
selleraider.com - no other listings under this identity, 4 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 4 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Depop page telemetry is posted to Discord webhooks.
Using SellerAider Toolkit on Depop can send page URLs and page-derived strings to Discord webhook endpoints: user-action telemetry, permission outcomes, refresh/relist error text, current page URLs, and product metadata from Depop.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
The user performs SellerAider Toolkit actions on Depop pages.
The extension posts telemetry, error strings, current page URLs, and product metadata to Discord webhook endpoints.
- Your Depop page URLhttps://www.depop.com/products/example-item (illustrative)
The current URL can identify which Depop page or listing was active when the extension sent the request.
- Page-derived contentRelist error on current Depop listing (illustrative)
Strings from the page or extension workflow can describe actions, errors, permission outcomes, or product details from the Depop session.
Where it sends data
Destinations our analysis observed Bot for Depop contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- discord.com/api/webhooks
Bot for Depop sends data to discord.com/api/webhooks. One other extension we have analysed sends data here.
- app.selleraider.com/api/sendDocument
Bot for Depop sends data to app.selleraider.com/api/sendDocument. No other extension we have analysed sends data here.
- app.selleraider.com/oops-depop
Bot for Depop sends data to app.selleraider.com/oops-depop. No other extension we have analysed sends data here.