Is DSM Auto-Paste Chrome Extension safe?

High risk

DSM Auto-Paste is high risk. Preparing an Amazon page for DSM listing reads the full page HTML and sends it via the background script to http://usage.dsmtool.com:3001/api/chromex/cache, as JSON with source, region, item_id, html. DNS resolution failed before capture.…

dsm-chromex-publishersv6.4.7Chrome Web Store
78Risk
Who publishes it

dsm-chromex-publishers - no other listings under this identity, 9 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
dsm-chromex-publishers

Shared hosts - 9 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

cocostrade.net
Also called by 1 other listing: KalDrop
fcocos.com
Also called by 1 other listing: KalDrop
tmart.com
Also called by 1 other listing: DSMATEPRO
tvc-mall.com
Also called by 1 other listing: GFC Invoice
chinabrands.com
Also called by 3 other listings, including Dropeex, Importify - AI Dropshipping Product Importer
dx.com
Also called by 3 other listings, including DSMATEPRO
chinavasion.com
Also called by 4 other listings, including Dropeex
kmart.com
Also called by 4 other listings
lightinthebox.com
Also called by 5 other listings, including GFC Invoice, DSMATEPRO, SuperDS - eBay Lister & Dropshipping Tool

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Amazon page HTML posted to dsmtool.com

Preparing an Amazon page for DSM listing reads the full page HTML and sends it via the background script to http://usage.dsmtool.com:3001/api/chromex/cache, as JSON with source, region, item_id, html.

DNS resolution failed before capture.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open an Amazon product page where the extension prepares its DSM listing control.

The product-page code calls the scraper when it finds a product ASIN.

The extension did this

The extension reads the page's complete HTML and prepares it for a POST to dsmtool.com.

The request fields are source, region, item_id, and html.

Fields the source code places in the POST payload
  • Marketplace source
    amazon

    Identifies which shopping site the page came from.

  • Amazon region
    US

    Shows the country-specific Amazon marketplace for the page you opened.

  • Amazon item ID
    B07FDJMC9Q

    Identifies the specific product page involved in the request.

  • Full page HTML
    <html><head><title>Amazon product detail</title></head><body id="dp">B07FDJMC9Q product detail page</body></html> (illustrative shape)

    Includes the rendered Amazon product page content available to the extension, which can include personalized page elements.

Captured request
POSThttp://usage.dsmtool.com:3001/api/chromex/cache

Name resolution failed before an HTTP response; no request body was captured.

The code that does this

The content script collects page HTML, then the background script posts it

Readable version

Amazon content script: readable scrapeProductPage

scripts/amazon.js
Amazon.prototype.scrapeProductPage = async function(e) {  const t = await getStorage("awaitClientdata");  setStorage("awaitClientdata", null);  const i = await getStorage("DSMRedirection");  if (setStorage("DSMRedirection", null), !e) {    if (!t || !i) return;    window.location.href = i  }  fetch(`https://${window.location.hostname}/gp/aod/ajax/ref=dp_aod_NEW_mbc?asin=${e}&m=&pinnedofferhash=&qid=&smid=&sourcecustomerorglistid=&sourcecustomerorglistitemid=&sr=`).then((e => {    if (200 == e.status) return e.text()  })).then((n => {    const s = document.querySelectorAll("script");    for (let e = 0; e < s.length; e++) {      let t = s[e];      t.innerText.includes("dataToReturn") || t.remove()    }    const a = document.querySelector('[data-action="thumb-action"]');    a && a.parentNode.parentNode.remove();    const r = document.createElement("div");    r.setAttribute("id", "dataContainer"), r.innerHTML = n;    const o = r.querySelector("#aod-offer-list");    if (!o) return;    o.setAttribute("id", "DSMSuppliersTable"), o.setAttribute("style", "display:none;"), document.body.append(o);    const d = this.getRegion(),      c = document.documentElement.innerHTML,      l = {        command: "send-clientdata",        source: this.name,        region: d,        item_id: e,        html: c      };    let u;    i && (u = setTimeout((() => {      window.location.href = i    }), 1e4)), sendMessageToBackground(l).then((e => console.log(e.data))).catch((e => console.log(e))).finally((() => {      t && i && (clearTimeout(u), window.location.href = i)    }))  })).catch((e => {    throw new Error(e)  }))}

Background script: readable sendClientData

scripts/backgroundNew.js
case 'send-clientdata':        sendClientData(request).finally(response => sendResponse({ data: response }));      return true;function sendClientData(request) {  return new Promise((resolve, reject) => {    const data = {      source: request.source,      region: request.region,      item_id: request.item_id,      html: request.html    }    timeoutPromise(5000,      fetch('http://usage.dsmtool.com:3001/api/chromex/cache', {        method: 'POST',        mode: 'cors', // no-cors, cors, *same-origin        cache: 'no-cache',        credentials: 'same-origin',        headers: {          'Content-Type': 'application/json; charset=utf-8',        },        redirect: 'follow',        referrer: 'no-referrer',        body: JSON.stringify(data), // body data type must match "Content-Type" header      })        .then(          (response) => {            console.log('Debug: -------------------------------------------');            console.log('Debug: sendClientData -> response', response);            console.log('Debug: -------------------------------------------');            return resolve(response);          }        )        .catch(          (error) => {            console.warn(error);            reject(error);          }        )    )      .catch(error => {        console.error(error);        reject(error);      })      .finally(() => clientDataSent = true);  });}
External destination named by the extension code
    • usage.dsmtool.com

    Receives the Amazon product-page payload at /api/chromex/cache on port 3001.

Home Depot product page JSON sent to DSMTool cache server.

Using the DSM Auto-Paste flow on a Home Depot page, the extension collects Home Depot product JSON, including product ID and metadata, and sends it to usage.dsmtool.com:3001/api/chromex/cache.

This only runs after a required user action.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

A required user action starts the DSM Auto-Paste flow on a Home Depot product page.

The extension did this

The extension fetches Home Depot product and metadata JSON, then sends the combined data to its cache endpoint.

Captured request
POSThttp://usage.dsmtool.com:3001/api/chromex/cache
Fields in the request
  • Home Depot product page content
    {"productId":"315388049","metadata":{...}} (illustrative)

    Product-page JSON can identify the item being viewed, including product ID, details, and variation metadata.

Observation

Dynamic analysis could not reproduce the network request because Home Depot security controls blocked the test page and the destination host did not resolve from the test environment. A later confirmation row documents the code path that fetches Home Depot product JSON and posts it to the DSMTool cache endpoint.

Saved pages send full HTML and URL to DSM save endpoint

Saving a page with DSM Auto-Paste posts the page URL and rendered HTML to app.dsmtool.com/chromex-test/save.

The transmitted DOM content can include page text and other details, so the save sends more than just the address.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

The user performs the extension's save action for a page.

The extension did this

The extension posts the saved page's rendered HTML and URL to the DSM save endpoint.

Captured request
POSTapp.dsmtool.com/chromex-test/save
Fields in the request
  • Saved page HTML
    <html><body>Saved page content</body></html> (illustrative)

    Contains the rendered DOM content from the page being saved.

  • Saved page URL
    https://www.example.com/product/123 (illustrative)

    Identifies which page was saved and provides browsing context.

+1 more finding not shown

What it can do

Permissions this extension asks for, as declared in version 6.4.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • See the address and title of every tab you have open

    tabs

  • Keep running in the background while your browser is open

    background

  • Read whatever you have copied to your clipboard

    clipboardRead

  • Write to your clipboard

    clipboardWrite

  • Store data in your browser

    storage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Add items to the right-click menu

    contextMenus

Updated 30 September 2026ecdbmkcphlholpojdglodopmlaficcji