Is hireEZ for Chrome - Find and Engage Anyone, Anywhere. safe?

Medium risk

hireEZ is medium risk. The background script batches log events tagged with your hireEZ team and user ID and sends them to hireEZ's own server every 10 seconds while you browse. We observed 48 POSTs fire automatically before any hireEZ login.

hireEZv8.1.2Chrome Web Store
45Risk
Who publishes it

hireEZ - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
hireEZ
Declared legal entity
hireEZ
Registered address
2513 E Charleston Rd, 200, Mountain View, CA 94085, US
Registered contact
hireEZ

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

hireEZ's background script logs your browsing to its own server every 10s

The background script batches log events tagged with your hireEZ team and user ID and sends them to hireEZ's own server every 10 seconds while you browse.

We observed 48 POSTs fire automatically before any hireEZ login.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You open or navigate to any page while the extension is active.

This starts firing right after the extension installs, before any hireEZ login.

The extension did this

The background script logs the event and batches it to hireEZ's own telemetry server.

We observed the batches firing automatically, unrelated to any hireEZ-hosted page.

When this fires

When a batch threshold is hit · flushes at 500 queued events

Flushes every 10 seconds, or immediately once 500 log entries queue up, whichever comes first.

Captured request
POSThttps://loggerservice.hireez.com/public/v1/bidata/batch/create

Server returned 200 with an empty body; no content to display.

Headers
Content-Type
application/json
Body
{  "logs": [    {      "teamId": "null",      "userId": "null-1757355867123",      "client": "extension",      "level": "debug",      "fromGA": false,      "timestamp": 1757355867123,      "payload": "{}"    }  ]}
Fields inside each batched log entry
  • hireEZ team ID
    team_48213 (reads as the string "null" when you're signed out)

    Identifies which company or workspace account you're using hireEZ under.

  • hireEZ user ID
    user_10294 (reads as null-1757355867123 when you're signed out)

    Identifies you individually inside your hireEZ team once you're signed in.

  • Client tag
    extension

    Marks the entry as coming from the browser extension rather than hireEZ's website.

  • Event timestamp
    1757355867123

    Records the exact moment your extension action or page navigation triggered the log.

  • Event payload
    {"error":"fetch failed"} (contents vary by event)

    Carries structured details about whatever background action triggered the log entry.

The code that does this

Batch logger settings pointing at hireEZ's log server

Readable version
    const {      LOGGER_SERVICE_API_URL: ne    } = c(), oe = async e => {      try {        await fetch(`${ne}/bidata/batch/create-v2`, {          method: "POST",          body: JSON.stringify(e),          headers: {            "Content-Type": "application/json"          }        })      } catch (e) {        ie(e)      }    }, ie = e => (t, r) => {      let n = t;      r && (n = t instanceof Error ? {        payload: {          error: t.message        },        stacktrace: t.stack      } : {        payload: {          error: t        }      }), e.error(JSON.stringify(n))    }, ae = {      log: e => (t, r) => {        let n = t;        r && "object" != typeof t && (n = {          payload: t        }), e.debug(JSON.stringify(n))      },      info: e => (t, r) => {        let n = t;        r && "object" != typeof t && (n = {          payload: t        }), e.info(JSON.stringify(n))      },      error: ie,      options: {        url: `${ne}/bidata/batch/create`,        method: "POST",        headers: {},        token: "",        timeout: 0,        interval: 1e4,        level: "trace",        backoff: {          multiplier: 2,          jitter: .1,          limit: 3e4        },        capacity: 500,        stacktrace: {          levels: ["trace", "info", "error"],          depth: 5,          excess: 0        },        timestamp: () => (new Date).valueOf(),        format: e => {          const t = JSON.parse(e.message),            r = e.level.label.toLowerCase();          let n;          "error" === r && (n = t.stacktrace || e.stacktrace);          const o = {            teamId: t.teamId || "null",            userId: t.userId || `null-${e.timestamp}`,            client: "extension",            level: r,            meta: t.meta,            fromGA: t.fromGA ?? !1,            timestamp: e.timestamp,            payload: JSON.stringify(t.payload),            stacktrace: n          };          if ("info" === r) {            const {              type: e,              category: r,              action: n,              count: i,              value: a,              tags: s            } = t;            return {              ...o,              type: e ?? "default",              category: r ?? "default",              action: n ?? "default",              count: i,              value: a,              tags: s            }          }          return o        }      }    }, se = ae;
Where the telemetry goes
    • loggerservice.hireez.com

    hireEZ's own backend logging service. Receives the batched log entries directly from the extension; not a separate ad-tech or analytics vendor.

Updated 30 September 2026jeablngoapekimaeoeclgcefdcpjhjcg