Is ECGO – 楽天RMS自動化・SEO分析ツール | ECマスターズ safe?
ECGO – 楽天RMS自動化・SEO分析ツール | ECマスターズ is high risk. This extension reads the item's full record, item ID, shop ID, category, price, on every Rakuten item page or RMS console, adds page/shop URLs and version, sends it to an AWS endpoint unrelated to rakuten.co.jp; replaces an earlier beacon.…
Who publishes itec-masters-apps - no other listings under this identity, 1 shared hostname
ec-masters-apps - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Item and Shop Data Sent to a Third-Party AWS Endpoint
This extension reads the item's full record, item ID, shop ID, category, price, on every Rakuten item page or RMS console, adds page/shop URLs and version, sends it to an AWS endpoint unrelated to rakuten.co.jp; replaces an earlier beacon.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a product page on item.rakuten.co.jp.
The same thing happens on the RMS main menu at mainmenu.rms.rakuten.co.jp, where the extension instead records your shop's storefront URL for later use.
The extension reads the item's full data record, adds the page URL, shop URL, and version number, and sends it to an AWS endpoint outside rakuten.co.jp.
The actual cross-origin POST is performed by the background service worker via a generic message relay, using fetch with credentials:'include'.
- Item ID10000501
Rakuten's internal identifier for the specific product you're viewing.
- Shop ID413100
Identifies which Rakuten storefront the item belongs to.
- Category and pricegenre 216058, ¥120
The product's Rakuten genre/category code and its listed price.
- Page URLhttps://item.rakuten.co.jp/happy-bell/allpen/
The exact item page you're viewing, including the shop name and product slug.
- Your shop's storefront URLhttps://www.rakuten.co.jp/happy-bell/
Read from the RMS main menu and attached to every item report, ties every report back to your specific Rakuten shop account.
- Extension version4.5.2
Which build of the extension sent the report.
200 OK, {"result":"Success"}
- Content-Type
- application/json
[ { "itemId": 10000501, "shopId": 413100, "data": { "genreId": 216058, "price": 120 }, "url": "https://item.rakuten.co.jp/happy-bell/allpen/", "ushopurl": "https://www.rakuten.co.jp/happy-bell/", "ext_version": "4.5.2" }]src/content/tracking.js, reads the item record and posts it off-site
class Tracking { static isExtensionContextValid() { try { return typeof chrome !== 'undefined' && !!chrome?.runtime?.id; } catch (e) { return false; } } static getTargetType() { const url = window.location.href; if (/^https:\/\/item\.rakuten\.co\.jp\//.test(url)) return 'product_detail_page'; if (/^https:\/\/mainmenu\.rms\.rakuten\.co\.jp\//.test(url)) return 'rms_main_menu'; return null; } load() { const type = Tracking.getTargetType(); if (type === 'rms_main_menu') this.handleRmsMainMenu(); else if (type === 'product_detail_page') this.handleProductDetailPage(); } // On the RMS shop-management main menu: read and store the shop's // storefront URL for later use in item reports. handleRmsMainMenu() { const run = () => { if (!Tracking.isExtensionContextValid()) return; const el = document.querySelector('#com_header_shop_url'); if (el && el.href) { const shopUrl = el.href.replace(/\?.*$/, ''); if (shopUrl) { chrome.storage.local.set({ ProductSend: { shopUrl } }); } } }; document.readyState === 'loading' ? document.addEventListener('DOMContentLoaded', run) : setTimeout(run, 500); } // On a Rakuten item detail page: read the full item data record, merge // in shop/page/version context, and POST it off-site. handleProductDetailPage() { const run = () => { if (!Tracking.isExtensionContextValid()) return; const el = document.querySelector('[data-view-type="ITEM"]'); if (!el || !el.getAttribute('data-item-data')) return setTimeout(run, 1000); const raw = el.getAttribute('data-item-data'); const parsed = JSON.parse(raw.replaceAll('NaN', '0').replaceAll(': ,', ': "",')); const items = Array.isArray(parsed) ? parsed : [parsed]; if (items.length === 0) return; chrome.storage.local.get(['ProductSend'], (stored) => { const shopUrl = stored?.ProductSend?.shopUrl || null; const pageUrl = window.location.href.replace(/\?.*$/, ''); const report = items.map((item) => ({ ...item, ...(shopUrl && { ushopurl: shopUrl }), url: pageUrl, ext_version: chrome.runtime.getManifest().version, })); // Relayed through the background service worker, which performs // the actual cross-origin fetch with credentials:'include'. chrome.runtime.sendMessage({ axios: { method: 'POST', url: 'https://h5u02k2zs3.execute-api.ap-northeast-1.amazonaws.com/prod/ritem', headers: { 'Content-Type': 'application/json' }, data: report, }, }); }); }; document.readyState === 'loading' ? document.addEventListener('DOMContentLoaded', run) : setTimeout(run, 500); }}- h5u02k2zs3.execute-api.ap-northeast-1.amazonaws.com
AWS endpoint receiving item ID, shop ID, category, price, and page/shop URLs from every Rakuten item page viewed. Successor to a beacon that sent these to azurewebsites.net.