Is EVIRMA 2 — экспертная аналитика продвижения и рекламы на Wildberries safe?
EVIRMA is medium risk. EVIRMA 2 reports page views to its own GA4 property, sending page_view (page title, normalized URL, persistent client ID from storage) each time its overlay renders on a seller-dashboard page or its popup, tying views to this install.…
Who publishes itEvirma - no other listings under this identity, 7 shared hostnames
Evirma - no other listings under this identity, 7 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 7 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension sends page-view analytics with dashboard URLs and titles to Google
EVIRMA 2 reports page views to its own GA4 property, sending page_view (page title, normalized URL, persistent client ID from storage) each time its overlay renders on a seller-dashboard page or its popup, tying views to this install.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
The user opens or navigates within the Wildberries seller-dashboard pages the extension overlays, or opens the extension's own popup.
The extension sends a page_view analytics event with the page title and URL to Google Analytics, tagged with a persistent client ID.
- Persistent client IDb7dccd2a-aa3c-46b6-af3e-c38db1756aeb
A UUID stored in extension storage that lets Google Analytics tie every event back to the same installation.
- Page title and URLpages/wb/main/product-stats-view — https://www.wildberries.ru/
The title of the page being viewed and a normalized version of its URL are sent with each event.
- Session IDgenerated per browsing session (illustrative)
A rotating identifier for the current browsing session, sent alongside each event.
Not recorded in the claim evidence.
{ "client_id": "b7dccd2a-aa3c-46b6-af3e-c38db1756aeb", "events": [ { "name": "page_view", "params": { "session_id": "<session>", "engagement_time_msec": 100, "page_title": "pages/wb/main/product-stats-view", "page_location": "https://www.wildberries.ru/" } } ]}GA4 Measurement Protocol page_view call
const GA4_ENDPOINT = `https://www.google-analytics.com/mp/collect`;const GA4_MEASUREMENT_ID = `G-9FCF3JCFL2`;const GA4_API_SECRET = `<redacted>`;const DEFAULT_ENGAGEMENT_MS = 100;async function sendEvent(name, paramsOrList) { const baseParams = { session_id: await getSessionId(), engagement_time_msec: DEFAULT_ENGAGEMENT_MS, debug_mode: config.isDev, }; const events = (Array.isArray(paramsOrList) ? paramsOrList : [paramsOrList]) .map(params => ({ name, params: { ...baseParams, ...params } })); const account = getAccount(); const userProps = account ? buildUserProperties(account) : {}; return fetch(`${GA4_ENDPOINT}?measurement_id=${GA4_MEASUREMENT_ID}&api_secret=${GA4_API_SECRET}`, { method: `POST`, body: JSON.stringify({ client_id: await getClientId(), events, ...userProps }), });}function fireEvent(name, params) { sendEvent(name, params).catch(() => {});}const analytics = { pageView: (pageTitle) => { fireEvent(`page_view`, { page_title: pageTitle, page_location: document.location.href.replace(/\d+/gi, `__id__`), }); },};- www.google-analytics.com
Receives page_view events (title, normalized URL, persistent client ID) via GA4 Measurement Protocol, under the extension's own Google Analytics property, owned by Google.
Extension error reports include a persistent device ID and full IP address
Logging an internal error reports it to Sentry (sentry.evde.ru), tagged with a device/session ID from storage, page URL, browser details, and a JS stack trace. sendDefaultPii is on, so the server also records the device's IP per error.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
An internal error occurs while the extension is running in the background.
The extension sends an error report to a third-party Sentry instance at sentry.evde.ru, tagged with a persistent device ID and session ID.
- Device IDb7dccd2a-aa3c-46b6-af3e-c38db1756aeb
A persistent identifier that lets the receiving Sentry instance link every error report back to the same installation over time.
- Session ID2e86a8c6-ac15-427f-bcff-52535cb33e1c
Identifies the current browsing session in which the error occurred.
- IP addressrecorded server-side via sendDefaultPii (illustrative)
Because the Sentry client has default PII collection enabled, the receiving server also records the reporting device's IP address.
- Page URL and stack tracehttps://www.wildberries.ru/ plus the JS call stack
The error report includes the page the user was on and a full JavaScript stack trace at the moment of the error.
Not recorded in the claim evidence.
{ "tags": { "clientId": "b7dccd2a-aa3c-46b6-af3e-c38db1756aeb", "clientSessionId": "2e86a8c6-ac15-427f-bcff-52535cb33e1c" }, "user": { "id": "b7dccd2a-aa3c-46b6-af3e-c38db1756aeb" }}Sentry client initialization and beforeSend tagging
sentryClient = new BrowserClient({ release: BUILD.release, dsn: `https://13d54211ade3462d24dcf5184ff63b77@sentry.evde.ru/7`, environment: `production`, sendDefaultPii: true, normalizeDepth: 10, integrations: enabledIntegrations, beforeSend: async (event, hint) => { lastEventId = event.event_id; const clientId = await getClientId(); const sessionId = await getSessionId(); const account = getAccount(); if (!shouldFilterEvent(hint.originalException, clientId, event.tags?.['saga-action'])) { event.user = { ...event.user, id: clientId }; event.tags = { ...event.tags, clientId, clientSessionId: sessionId, userId: account?.id, tariff: account?.tariff.value, hasWbToken: account?.wbToken.has, }; return event; } return null; }})- sentry.evde.ru
Receives tagged error reports (device ID, session ID, stack trace, page context) and, via sendDefaultPii, the device's IP. A third-party Sentry instance error traffic routes to.