Is DSM Auto-Paste Chrome Extension safe?
DSM Auto-Paste is high risk. Preparing an Amazon page for DSM listing reads the full page HTML and sends it via the background script to http://usage.dsmtool.com:3001/api/chromex/cache, as JSON with source, region, item_id, html. DNS resolution failed before capture.…
Who publishes itdsm-chromex-publishers - no other listings under this identity, 9 shared hostnames
dsm-chromex-publishers - no other listings under this identity, 9 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 9 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Amazon page HTML posted to dsmtool.com
Preparing an Amazon page for DSM listing reads the full page HTML and sends it via the background script to http://usage.dsmtool.com:3001/api/chromex/cache, as JSON with source, region, item_id, html.
DNS resolution failed before capture.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You open an Amazon product page where the extension prepares its DSM listing control.
The product-page code calls the scraper when it finds a product ASIN.
The extension reads the page's complete HTML and prepares it for a POST to dsmtool.com.
The request fields are source, region, item_id, and html.
- Marketplace sourceamazon
Identifies which shopping site the page came from.
- Amazon regionUS
Shows the country-specific Amazon marketplace for the page you opened.
- Amazon item IDB07FDJMC9Q
Identifies the specific product page involved in the request.
- Full page HTML<html><head><title>Amazon product detail</title></head><body id="dp">B07FDJMC9Q product detail page</body></html> (illustrative shape)
Includes the rendered Amazon product page content available to the extension, which can include personalized page elements.
Name resolution failed before an HTTP response; no request body was captured.
The content script collects page HTML, then the background script posts it
Amazon content script: readable scrapeProductPage
scripts/amazon.jsAmazon.prototype.scrapeProductPage = async function(e) { const t = await getStorage("awaitClientdata"); setStorage("awaitClientdata", null); const i = await getStorage("DSMRedirection"); if (setStorage("DSMRedirection", null), !e) { if (!t || !i) return; window.location.href = i } fetch(`https://${window.location.hostname}/gp/aod/ajax/ref=dp_aod_NEW_mbc?asin=${e}&m=&pinnedofferhash=&qid=&smid=&sourcecustomerorglistid=&sourcecustomerorglistitemid=&sr=`).then((e => { if (200 == e.status) return e.text() })).then((n => { const s = document.querySelectorAll("script"); for (let e = 0; e < s.length; e++) { let t = s[e]; t.innerText.includes("dataToReturn") || t.remove() } const a = document.querySelector('[data-action="thumb-action"]'); a && a.parentNode.parentNode.remove(); const r = document.createElement("div"); r.setAttribute("id", "dataContainer"), r.innerHTML = n; const o = r.querySelector("#aod-offer-list"); if (!o) return; o.setAttribute("id", "DSMSuppliersTable"), o.setAttribute("style", "display:none;"), document.body.append(o); const d = this.getRegion(), c = document.documentElement.innerHTML, l = { command: "send-clientdata", source: this.name, region: d, item_id: e, html: c }; let u; i && (u = setTimeout((() => { window.location.href = i }), 1e4)), sendMessageToBackground(l).then((e => console.log(e.data))).catch((e => console.log(e))).finally((() => { t && i && (clearTimeout(u), window.location.href = i) })) })).catch((e => { throw new Error(e) }))}Background script: readable sendClientData
scripts/backgroundNew.jscase 'send-clientdata': sendClientData(request).finally(response => sendResponse({ data: response })); return true;function sendClientData(request) { return new Promise((resolve, reject) => { const data = { source: request.source, region: request.region, item_id: request.item_id, html: request.html } timeoutPromise(5000, fetch('http://usage.dsmtool.com:3001/api/chromex/cache', { method: 'POST', mode: 'cors', // no-cors, cors, *same-origin cache: 'no-cache', credentials: 'same-origin', headers: { 'Content-Type': 'application/json; charset=utf-8', }, redirect: 'follow', referrer: 'no-referrer', body: JSON.stringify(data), // body data type must match "Content-Type" header }) .then( (response) => { console.log('Debug: -------------------------------------------'); console.log('Debug: sendClientData -> response', response); console.log('Debug: -------------------------------------------'); return resolve(response); } ) .catch( (error) => { console.warn(error); reject(error); } ) ) .catch(error => { console.error(error); reject(error); }) .finally(() => clientDataSent = true); });}- usage.dsmtool.com
Receives the Amazon product-page payload at /api/chromex/cache on port 3001.
Home Depot product page JSON sent to DSMTool cache server.
Using the DSM Auto-Paste flow on a Home Depot page, the extension collects Home Depot product JSON, including product ID and metadata, and sends it to usage.dsmtool.com:3001/api/chromex/cache.
This only runs after a required user action.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
A required user action starts the DSM Auto-Paste flow on a Home Depot product page.
The extension fetches Home Depot product and metadata JSON, then sends the combined data to its cache endpoint.
- Home Depot product page content{"productId":"315388049","metadata":{...}} (illustrative)
Product-page JSON can identify the item being viewed, including product ID, details, and variation metadata.
Dynamic analysis could not reproduce the network request because Home Depot security controls blocked the test page and the destination host did not resolve from the test environment. A later confirmation row documents the code path that fetches Home Depot product JSON and posts it to the DSMTool cache endpoint.
Saved pages send full HTML and URL to DSM save endpoint
Saving a page with DSM Auto-Paste posts the page URL and rendered HTML to app.dsmtool.com/chromex-test/save.
The transmitted DOM content can include page text and other details, so the save sends more than just the address.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
The user performs the extension's save action for a page.
The extension posts the saved page's rendered HTML and URL to the DSM save endpoint.
- Saved page HTML<html><body>Saved page content</body></html> (illustrative)
Contains the rendered DOM content from the page being saved.
- Saved page URLhttps://www.example.com/product/123 (illustrative)
Identifies which page was saved and provides browsing context.
+1 more finding not shown
What it can do
Permissions this extension asks for, as declared in version 6.4.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
See the address and title of every tab you have open
tabs
Keep running in the background while your browser is open
background
Read whatever you have copied to your clipboard
clipboardRead
Write to your clipboard
clipboardWrite
Store data in your browser
storage
Block and redirect the requests your browser makes
declarativeNetRequest
See which of your requests its blocking rules matched
declarativeNetRequestFeedback
Read and change cookies, including the ones that keep you signed in
cookies
Add items to the right-click menu
contextMenus