Is Анабар — бесплатная аналитика маркетплейсов safe?

Medium risk

Анабар posts marketplace navigation URLs to anabar.ai when users browse Wildberries or Ozon.

The extension watches navigation changes on wildberries.ru and ozon.ru and sends the current marketplace page URL to its clickstream API. The request is posted as JSON to anabar.ai with browser credentials included.

dmitry.sizonv2.4.4Chrome Web Store
45Risk
Who publishes it

ООО «МАРКЕТГУРУ» - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
dmitry.sizon
Declared legal entity
ООО «МАРКЕТГУРУ»
Registered address
пл. Восстания, д. 3, к. 2, этаж/литер 2/А пом. 3, Таганрог, Ростовская область 347904, RU
Registered contact
MarketGuru

Same operator - 1 listing

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

MarketGuru
same registered address
100k+Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Anabar posts every Wildberries and Ozon page you visit to its own servers

Each time you navigate within Wildberries or Ozon with Anabar installed, the extension sends the exact page URL to anabar.ai's clickstream endpoint with your session cookies attached.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate to a new page on Wildberries or Ozon without a full page reload.

The extension did this

The extension sends the URL you just navigated to to anabar.ai, with your session cookies attached.

Captured request
POSThttps://anabar.ai/api/chrome/v1/clickstream
Headers
Content-Type
application/json
Body
{  "page": "https://www.wildberries.ru/",  "info": {}}
The code that does this

Navigation listener (background) and clickstream POST (content script)

Readable version

Background service worker: navigation listener

background.js
chrome.webNavigation.onHistoryStateUpdated.addListener(  function (details) {    var url = details.url, tabId = details.tabId;    if (url) {      chrome.tabs.sendMessage(tabId, {        type: "ANABAR_EXTENSION_MESSAGE_CLICK_STREAM",        payload: { url: url }      });    }  },  { url: [{ hostContains: "wildberries.ru" }, { hostContains: "ozon.ru" }] });

Content script: message handler and debounced sender

app.js
chrome.runtime.onMessage.addListener(function (message) {  if (message.type === "ANABAR_EXTENSION_MESSAGE") {    checkAuth();    setIsAuth({ ok: true });  }  if (message.type === "ANABAR_EXTENSION_MESSAGE_CLICK_STREAM") {    var url = message.payload.url;    sendClickStreamDebounced(url);  }});var sendClickStreamDebounced = debounce(function (url) {  postClickStream({ page: url, info: {} });}, 300);

API client: clickstream request builder and fetch wrapper

app.js
var API_HOST = "https://anabar.ai/api/chrome/v1";function apiFetch(path, options) {  return fetch(    API_HOST + "/" + path,    Object.assign({ mode: "cors", credentials: "include" }, options)  );}function postClickStream(event) {  var body = { page: event.page, info: event.info };  return apiFetch("clickstream", {    method: "POST",    headers: new Headers({ "Content-Type": "application/json" }),    body: JSON.stringify(body)  });}
Fields in the clickstream request body
  • Page you're viewing
    https://www.wildberries.ru/catalog/is/product/158274093

    The exact product, search, or category page you navigated to on the marketplace, tied to your session by the cookies sent alongside it.

  • Extra info
    {}

    Reserved for additional context fields. Sent as an empty object in the observed request.

Where the navigation data goes
    • anabar.ai

    Anabar's own backend, the marketplace-analytics service this extension is the client for. Receives every marketplace page URL you navigate to, with your session cookies attached.

What it can do

Permissions this extension asks for, as declared in version 2.4.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on wb.ru

    https://*.wb.ru/*

  • Read and change your data on wildberries.am

    https://*.wildberries.am/*

  • Read and change your data on wildberries.by

    https://*.wildberries.by/*

  • Read and change your data on wildberries.eu

    https://*.wildberries.eu/*

  • Read and change your data on wildberries.kg

    https://*.wildberries.kg/*

  • Read and change your data on wildberries.kz

    https://*.wildberries.kz/*

  • Read and change your data on wildberries.ru

    https://*.wildberries.ru/*

  • Read and change your data on wildberries.tj

    https://*.wildberries.tj/*

  • Read and change your data on anabar.ai

    https://*.anabar.ai/*

  • Read and change your data on ozon.ru

    https://*.ozon.ru/*

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

Where it sends data

Destinations our analysis observed Анабар — бесплатная аналитика маркетплейсов contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • anabar.ai

    Анабар — бесплатная аналитика маркетплейсов sends data to anabar.ai. No other extension we have analysed sends data here.

Updated 30 September 2026ielhlapjkadmofokmkmhglhdoadelmdf