Is CRM NaKanikuly Помічник safe?

Low risk

CRM NaKanikuly Assistant stores your CRM session token and answers page messages with saved tour-operator logins.

The extension copies the session token from the Moituristy CRM page into extension storage and sends it to crm.nakanikuly.com to fetch the agency's saved tour-operator logins and passwords for auto-login. On tour-operator sites, a page message listener returns those credentials with a window message without checking where the request came from, so any script on that page could read them. This applies when the user is signed into the CRM with auto-login enabled.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

nakanikulyv3.0.2Chrome Web Store
15Risk
Who publishes it

nakanikuly - no other listings under this identity, 10 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
nakanikuly
Website
crm.nakanikuly.com/

Shared hosts - 10 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

new.moituristy.com
Also called by 1 other listing: MoiTuristy Helper
new.moituristy.dev07.odev.io
Also called by 1 other listing: MoiTuristy Helper
tat.moituristy.dev07.odev.io
Also called by 1 other listing: MoiTuristy Helper
agencyapi.coraltravel.lt
Also called by 2 other listings
crm.tat.ua
Also called by 2 other listings, including ITERIOS Travel Agent
id.mouzenidis-travel.ru
Also called by 2 other listings, including MoiTuristy Helper
id.mouzenidis.com
Also called by 2 other listings
pegast.com.ua
Also called by 2 other listings
plugin.moituristy.com
Also called by 2 other listings
moituristy.com
Also called by 3 other listings, including All-Inclusive CRM, XO Pulse

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 3.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on crm.nakanikuly.com

    https://crm.nakanikuly.com/*

  • Read and change your data on new.moituristy.com

    https://new.moituristy.com/*

  • Read and change your data on moituristy.com

    https://moituristy.com/*

  • Read and change your data on new.moituristy.dev07.odev.io

    http://new.moituristy.dev07.odev.io/*

  • Read and change your data on new.moituristy.localhost

    http://new.moituristy.localhost/*

  • Read and change your data on crm.tat.ua

    https://crm.tat.ua/*

  • Read and change your data on tat.moituristy.dev07.odev.io

    http://tat.moituristy.dev07.odev.io/*

  • Read and change your data on tat.moituristy.localhost

    http://tat.moituristy.localhost/*

  • Read and change your data on online3.anextour.com.ua

    *://online3.anextour.com.ua/*

  • Read and change your data on online.joinup.ua

    *://online.joinup.ua/*

  • Read and change your data on online.joinup.lt

    *://online.joinup.lt/*

  • Read and change your data on online.joinup.lv

    *://online.joinup.lv/*

  • Read and change your data on online.joinup.ee

    *://online.joinup.ee/*

  • Read and change your data on online.joinup.md

    *://online.joinup.md/*

  • Read and change your data on online.joinupbaltic.eu

    *://online.joinupbaltic.eu/*

  • Read and change your data on b2b.tui.ua

    *://b2b.tui.ua/*

  • Read and change your data on agent.teztour.ua

    *://agent.teztour.ua/*

  • Read and change your data on agent.teztour.lt

    *://agent.teztour.lt/*

  • Read and change your data on agent.teztour.lv

    *://agent.teztour.lv/*

  • Read and change your data on agent.teztour.ee

    *://agent.teztour.ee/*

  • Read and change your data on plus.teztour.kz

    *://plus.teztour.kz/*

  • Read and change your data on online.tez-tour.com

    *://online.tez-tour.com/*

  • Read and change your data on agent.tripsoft.eu

    *://agent.tripsoft.eu/*

  • Read and change your data on pegast.com.ua

    *://pegast.com.ua/*

  • Read and change your data on pegasys.pegast.com.ua

    *://pegasys.pegast.com.ua/*

  • Read and change your data on pegast.ge

    *://pegast.ge/*

  • Read and change your data on uz.pegast.asia

    *://uz.pegast.asia/*

  • Read and change your data on kg.pegast.asia

    *://kg.pegast.asia/*

  • Read and change your data on kz.pegast.asia

    *://kz.pegast.asia/*

  • Read and change your data on online.coraltravel.com.ua

    *://online.coraltravel.com.ua/*

  • Read and change your data on online.coraltravel.ua

    *://online.coraltravel.ua/*

  • Read and change your data on online.coraltravel.lt

    *://online.coraltravel.lt/*

  • Read and change your data on online.coraltravel.lv

    *://online.coraltravel.lv/*

  • Read and change your data on online.coraltravel.ee

    *://online.coraltravel.ee/*

  • Read and change your data on agency.coraltravel.lt

    *://agency.coraltravel.lt/*

  • Read and change your data on agency.coraltravel.ua

    *://agency.coraltravel.ua/*

  • Read and change your data on www.tpg.ua

    *://www.tpg.ua/*

  • Read and change your data on agent.tpg.ua

    *://agent.tpg.ua/*

  • Read and change your data on online.kompastour.com.ua

    *://online.kompastour.com.ua/*

  • Read and change your data on online.kompastour.com

    *://online.kompastour.com/*

  • Read and change your data on online.kompastour.uz

    *://online.kompastour.uz/*

  • Read and change your data on samo.orbita.ua

    *://samo.orbita.ua/*

  • Read and change your data on online.alf.ua

    *://online.alf.ua/*

  • Read and change your data on online.alf-ua.com

    *://online.alf-ua.com/*

  • Read and change your data on www.mouzenidis-travel.ru

    *://www.mouzenidis-travel.ru/*

  • Read and change your data on www.mouzenidis.com

    *://www.mouzenidis.com/*

  • Read and change your data on www.zeus.travel

    *://www.zeus.travel/*

  • Read and change your data on www.accordtour.com

    *://www.accordtour.com/*

  • Read and change your data on online.lyubosvit.com.ua

    *://online.lyubosvit.com.ua/*

  • Read and change your data on tcc.com.ua

    *://tcc.com.ua/*

  • Read and change your data on online.travel-life.pro

    *://online.travel-life.pro/*

  • Read and change your data on online.siesta.kiev.ua

    *://online.siesta.kiev.ua/*

  • Read and change your data on register.health.gov.tr

    *://register.health.gov.tr/*

  • Read and change your data on eticket.migracion.gob.do

    *://eticket.migracion.gob.do/*

  • Read and change your data on travel.gov.gr

    *://travel.gov.gr/*

  • Read and change your data on afyamsafiri.moh.go.tz

    *://afyamsafiri.moh.go.tz/*

  • Read and change your data on online.adriahit.com

    *://online.adriahit.com/*

  • Read and change your data on online.alliance.ua

    *://online.alliance.ua/*

  • Read and change your data on search.xclusivetravel.com

    *://search.xclusivetravel.com/*

  • Read and change your data on online.uz-prestige.com

    *://online.uz-prestige.com/*

  • Read and change your data on humotouroperator.uz

    *://humotouroperator.uz/*

  • Read and change your data on b2b.selfietravel.kz

    *://b2b.selfietravel.kz/*

  • Read and change your data on online.canaan.uz

    *://online.canaan.uz/*

  • Read and change your data on online.kazunion.com

    *://online.kazunion.com/*

  • Read and change your data on samo.lbt-service.com

    *://samo.lbt-service.com/*

  • Read and change your data on b2b.fstravel.kz

    *://b2b.fstravel.kz/*

  • Read and change your data on b2b.abktourism.kz

    *://b2b.abktourism.kz/*

  • Read and change your data on online.bktravel.kz

    *://online.bktravel.kz/*

  • Read and change your data on online.protour.tech

    *://online.protour.tech/*

  • Read and change your data on online.voyagergroup.kg

    *://online.voyagergroup.kg/*

  • Read and change your data on online.voyagergroup.kz

    *://online.voyagergroup.kz/*

  • Read and change your data on online.voyagergroup.az

    *://online.voyagergroup.az/*

  • Read and change your data on online.voyagergroup.tj

    *://online.voyagergroup.tj/*

  • Read and change your data on online.voyagergroup.uz

    *://online.voyagergroup.uz/*

  • Read and change your data on reserv.novatours.eu

    *://reserv.novatours.eu/*

  • Read and change your data on online.adriatic-travel.com.ua

    *://online.adriatic-travel.com.ua/*

  • Read and change your data on new.pilon.net.ua

    *://new.pilon.net.ua/*

  • Read and change your data on online.yantour.com.ua

    *://online.yantour.com.ua/*

  • Read and change your data on online.davclub.ua

    *://online.davclub.ua/*

  • Read and change your data on online.aristeya.com.ua

    *://online.aristeya.com.ua/*

  • Read and change your data on online.albena.com.ua

    *://online.albena.com.ua/*

  • Read and change your data on samo.feeria.ua

    *://samo.feeria.ua/*

  • Read and change your data on online.feeria.ua

    *://online.feeria.ua/*

  • Read and change your data on samo.tour-group.com.ua

    *://samo.tour-group.com.ua/*

  • Read and change your data on online.cntr.com.ua

    *://online.cntr.com.ua/*

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed CRM NaKanikuly Помічник contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • crm.nakanikuly.com

    CRM NaKanikuly Помічник sends data to crm.nakanikuly.com. No other extension we have analysed sends data here.

Updated 15 October 2026lhdlfiafilndphjpdajopnoffiliemlh