Is ECGO – 楽天RMS自動化・SEO分析ツール | ECマスターズ safe?

High risk

ECGO – 楽天RMS自動化・SEO分析ツール | ECマスターズ is high risk. This extension reads the item's full record, item ID, shop ID, category, price, on every Rakuten item page or RMS console, adds page/shop URLs and version, sends it to an AWS endpoint unrelated to rakuten.co.jp; replaces an earlier beacon.…

ec-masters-appsv4.6.3Chrome Web Store
69Risk
Who publishes it

ec-masters-apps - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ec-masters-apps

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

glogin.rms.rakuten.co.jp
Also called by 5 other listings, including OneLogin, OneLogin Extension

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Item and Shop Data Sent to a Third-Party AWS Endpoint

This extension reads the item's full record, item ID, shop ID, category, price, on every Rakuten item page or RMS console, adds page/shop URLs and version, sends it to an AWS endpoint unrelated to rakuten.co.jp; replaces an earlier beacon.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a product page on item.rakuten.co.jp.

The same thing happens on the RMS main menu at mainmenu.rms.rakuten.co.jp, where the extension instead records your shop's storefront URL for later use.

The extension did this

The extension reads the item's full data record, adds the page URL, shop URL, and version number, and sends it to an AWS endpoint outside rakuten.co.jp.

The actual cross-origin POST is performed by the background service worker via a generic message relay, using fetch with credentials:'include'.

What's sent on every Rakuten item page view
  • Item ID
    10000501

    Rakuten's internal identifier for the specific product you're viewing.

  • Shop ID
    413100

    Identifies which Rakuten storefront the item belongs to.

  • Category and price
    genre 216058, ¥120

    The product's Rakuten genre/category code and its listed price.

  • Page URL
    https://item.rakuten.co.jp/happy-bell/allpen/

    The exact item page you're viewing, including the shop name and product slug.

  • Your shop's storefront URL
    https://www.rakuten.co.jp/happy-bell/

    Read from the RMS main menu and attached to every item report, ties every report back to your specific Rakuten shop account.

  • Extension version
    4.5.2

    Which build of the extension sent the report.

Captured request
POSThttps://h5u02k2zs3.execute-api.ap-northeast-1.amazonaws.com/prod/ritem

200 OK, {"result":"Success"}

Headers
Content-Type
application/json
Body
[  {    "itemId": 10000501,    "shopId": 413100,    "data": {      "genreId": 216058,      "price": 120    },    "url": "https://item.rakuten.co.jp/happy-bell/allpen/",    "ushopurl": "https://www.rakuten.co.jp/happy-bell/",    "ext_version": "4.5.2"  }]
The code that does this

src/content/tracking.js, reads the item record and posts it off-site

Readable version
class Tracking {  static isExtensionContextValid() {    try { return typeof chrome !== 'undefined' && !!chrome?.runtime?.id; }    catch (e) { return false; }  }  static getTargetType() {    const url = window.location.href;    if (/^https:\/\/item\.rakuten\.co\.jp\//.test(url)) return 'product_detail_page';    if (/^https:\/\/mainmenu\.rms\.rakuten\.co\.jp\//.test(url)) return 'rms_main_menu';    return null;  }  load() {    const type = Tracking.getTargetType();    if (type === 'rms_main_menu') this.handleRmsMainMenu();    else if (type === 'product_detail_page') this.handleProductDetailPage();  }  // On the RMS shop-management main menu: read and store the shop's  // storefront URL for later use in item reports.  handleRmsMainMenu() {    const run = () => {      if (!Tracking.isExtensionContextValid()) return;      const el = document.querySelector('#com_header_shop_url');      if (el && el.href) {        const shopUrl = el.href.replace(/\?.*$/, '');        if (shopUrl) {          chrome.storage.local.set({ ProductSend: { shopUrl } });        }      }    };    document.readyState === 'loading'      ? document.addEventListener('DOMContentLoaded', run)      : setTimeout(run, 500);  }  // On a Rakuten item detail page: read the full item data record, merge  // in shop/page/version context, and POST it off-site.  handleProductDetailPage() {    const run = () => {      if (!Tracking.isExtensionContextValid()) return;      const el = document.querySelector('[data-view-type="ITEM"]');      if (!el || !el.getAttribute('data-item-data')) return setTimeout(run, 1000);      const raw = el.getAttribute('data-item-data');      const parsed = JSON.parse(raw.replaceAll('NaN', '0').replaceAll(': ,', ': "",'));      const items = Array.isArray(parsed) ? parsed : [parsed];      if (items.length === 0) return;      chrome.storage.local.get(['ProductSend'], (stored) => {        const shopUrl = stored?.ProductSend?.shopUrl || null;        const pageUrl = window.location.href.replace(/\?.*$/, '');        const report = items.map((item) => ({          ...item,          ...(shopUrl && { ushopurl: shopUrl }),          url: pageUrl,          ext_version: chrome.runtime.getManifest().version,        }));        // Relayed through the background service worker, which performs        // the actual cross-origin fetch with credentials:'include'.        chrome.runtime.sendMessage({          axios: {            method: 'POST',            url: 'https://h5u02k2zs3.execute-api.ap-northeast-1.amazonaws.com/prod/ritem',            headers: { 'Content-Type': 'application/json' },            data: report,          },        });      });    };    document.readyState === 'loading'      ? document.addEventListener('DOMContentLoaded', run)      : setTimeout(run, 500);  }}
Where item and shop data ends up
    • h5u02k2zs3.execute-api.ap-northeast-1.amazonaws.com

    AWS endpoint receiving item ID, shop ID, category, price, and page/shop URLs from every Rakuten item page viewed. Successor to a beacon that sent these to azurewebsites.net.

Updated 30 September 2026apjpmocfcdmmjcgcbipfhjfcjhlkfhmc