Is DS Amazon Quick View Extended safe?

Medium risk

DS Amazon Quick View is medium risk. We observed DS Amazon Quick View Extended POST to dmitry.artamoshkin.com during license validation. The body's license_key field was undefined here; the code populates it from the value passed into the Gumroad license verifier.

amidartv3.3.38Chrome Web Store
45Risk
Who publishes it

amidart - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
amidart
Registered address
Calle 92, Playa del Carmen, Quintana Roo 77728, Mexico
Registered contact
Dmitry Artamoshkin

Same store account

2 other listings published from this account, 570k+ users between them, none of them carrying a finding.

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

crushtrk.com
Also called by 3 other listings, including AMZ Seller Browser

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

License key sent during validation

We observed DS Amazon Quick View Extended POST to dmitry.artamoshkin.com during license validation.

The body's license_key field was undefined here; the code populates it from the value passed into the Gumroad license verifier.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You use a premium feature path that causes the extension to validate its license state.

The extension did this

The extension sends a license_key field to dmitry.artamoshkin.com and updates open tabs with license state.

02EvidenceFIELD TABLE
Fields involved in the license validation request and state update
FieldValueWhy it matters
License key field
license_key=undefinedThe value used to validate the extension license. If a real key is saved, it can identify the license or subscription tied to you.
Cached license record
gumroad.keyThis lets the extension remember whether the same saved key was recently accepted.
License state broadcast
license: "ok"Open extension content scripts receive whether premium functionality is active.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://dmitry.artamoshkin.com/ds/license.php
Body
license_key=undefined
04EvidenceCODE COMPARE
The code that does this

License validation and tab state broadcast in shipped code

What it actually does
Gumroad license verifierjs/background.js
var Gumroad = function() {
  var e = "",
    r = 0,
    t = "",
    o = {},
    n = function(e) {
      chrome.storage.local.get("gumroad", (function(e) {
        e.gumroad && (r = e.gumroad.ts, o = e.gumroad.res, t = e.gumroad.key)
      }))
    },
    a = function(r) {
      return new Promise((function(t, o) {
        r || o({
          error: !0,
          data: "No license key specified"
        }), e || o({
          error: !0,
          data: "Empty product id"
        });
        fetch("https://dmitry.artamoshkin.com/ds/license.php", {
          method: "POST",
          mode: "cors",
          body: new URLSearchParams({
            license_key: r
          })
        }).then((function(e) {
          if (!e.ok) throw e;
          return e
        })).then((function(e) {
          return e.text()
        })).then((function(e) {
          console.log(e);
          try {
            json = JSON.parse(e)
          } catch (e) {
            json = response
          }
          var o = s(json, r);
          t(o)
        })).catch((function(e) {
          if ("object" == typeof e && e.message) o({
            error: !0,
            data: e.message
          });
          else if ("object" == typeof e && e.status) {
            var r = {
              error: !0,
              data: "Error: " + e.status + " " + e.statusText
            };
            o(r)
          }
        }))
      }))
    },
    s = function(e, n) {
      if (!e.success) return {
        error: !0,
        data: e.message
      };
      var a = {
        error: !1,
        data: e
      };
      return function(e, n) {
        r = Date.now(), o = n, t = e, chrome.storage.local.set({
          gumroad: {
            ts: r,
            res: o,
            key: t
          }
        })
      }(n, a), a
    };
  return {
    init: function(r) {
      r.productId && (e = r.productId), n()
    },
    get: function(e) {
      return Date.now() - r < 1728e5 && e === t ? Promise.resolve(o) : a(e)
    },
    verify: a
  }
}();
Broadcast of license/settings state to all tabsjs/background.js
      u = function() {
        chrome.tabs.query({}, (function(t) {
          for (var i = 0, a = t.length; i < a; i++) chrome.tabs.sendMessage(t[i].id, {
            cmd: "app.update_state",
            data: {
              state: e,
              license: r,
              settings: n
            }
          }, (function(e) {}))
        }))
      },
05EvidenceTHIRD PARTY LIST
External destination reached by the validation request
  • dmitry.artamoshkin.com

    Receives the license validation POST for DS Amazon Quick View Extended.

Updated 30 September 2026ilpimgbmpmhfhdaaeepjokoigelkfbee