Is Dropshipping Marketplace Helper Pro safe?
Dropshipping Marketplace Helper Pro has a dormant page-scraper a remote config push could switch on for every site.
The content script includes a postMessage handler that, when it runs in a subframe, replies to any page's request with that frame's full HTML by posting it back to whatever origin asked, without checking who's asking. Today the extension only injects into top-level frames, so the handler never fires - but the list of frames it injects into is not fixed in the extension code. It is pulled from a JSON config the background script fetches from the vendor's own server and applied automatically every few minutes, so the vendor could switch on subframe injection at any time and reach every page a user has open, with no new code submitted to the Chrome Web Store.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes itovszon.com - 1 other listing from the same operator, 1 of them carrying a finding
ovszon.com - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 100k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed Dropshipping Marketplace Helper Pro contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.ovszon.com
Dropshipping Marketplace Helper Pro sends data to www.ovszon.com. No other extension we have analyzed sends data here.