Is Comidoc safe?
Comidoc is medium risk. Comidoc sends a persistent installation ID and a device fingerprint to third-party analytics service extension.report on install and repeatedly after. A Settings toggle can turn this off, but it ships on by default.
Who publishes itAMOREM - no other listings under this identity
AMOREM - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Comidoc reports your device fingerprint and a persistent ID to extension.report
Comidoc sends a persistent installation ID and a device fingerprint to third-party analytics service extension.report on install and repeatedly after.
A Settings toggle can turn this off, but it ships on by default.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install Comidoc, the Udemy coupon-finder extension.
No consent prompt appears before telemetry starts.
Comidoc starts the extension.report analytics SDK and sends a device fingerprint plus a persistent installation ID to it right away.
The same data is resent on every heartbeat, popup open, and Udemy course you click or check for a coupon.
- Installation ID44b2390f-56dc-496d-a693-1bba4aae92a3
A UUID resent with every event, letting extension.report recognize this browser across sessions without an account.
- Comidoc account identityusername: udemy_shopper42, plan: free
When you sign in to Comidoc, your account username and subscription plan are attached to the same telemetry stream.
- Browser and OSChrome 128.0.6613, macOS, arm64
Your exact browser name, version, operating system, and CPU architecture.
- Hardware profile8 cores, 8 GB memory
CPU core count and device memory, narrowing down which physical machine you're using.
- Locale, timezone and displayen-US, UTC-4, 1920x1080, dark mode
Your language settings, timezone offset, screen resolution, and color scheme preference.
- Udemy course activitycourse_click: udemy_id 4736182
Which Udemy courses you click on and check for coupons, sent as separate events tied to the same installation ID.
Hardcoded project key and account-linking identify call
SDK initialization (background.js)
background.jsvar aa = () => qn({ projectPublicKey: `pk_er_add56b4c5d12c8334a0b7cae2340f52abb3a`, instrumentation: { automatic: !0, adoption: !0, engagement: !0, reliability: `full` } }), oa = null, sa = 0, ca = 0, la = null, ua = null;Building the identify() payload from your Comidoc account
background.jsfunction da(e) { if (!e) return `anonymous`; let t = e.traits ? JSON.stringify(e.traits) : ``; return `${e.userId??``}|${t}` } async function fa(e = !1) { let t = Date.now(); if (!e && sa && t - sa < Xi) return oa; try { let e = await Ue(), n = e.username ?? null, r = typeof e.premium == `boolean` ? e.premium : null, i = e.planType ?? null; return oa = { userId: n, traits: { username: n, premium: r, entitlement_type: r === null ? null : r ? `paid` : `free`, entitlement_status: r === null ? null : r ? `active` : null, plan_code: i, has_user_id: !!n } }, sa = t, oa } catch (e) { return e instanceof M && e.status === 401 ? (oa = null, sa = t, oa) : oa } }Returned 200 with an updated config version and, on first delivery, an uninstall_token that Comidoc registers via chrome.runtime.setUninstallURL.
Returns live JSON config (sampling rates, per-event enable flags) scoped to Comidoc's hardcoded project key.
- extension.report
Third-party extension-analytics platform (the @extension-report/js SDK). Receives Comidoc's device fingerprints, installation IDs, account identity, and course-browsing events.
On an interval
Fires immediately on install, then again on a recurring heartbeat and on every popup open, setting change, course click, and coupon check.