Is DS Amazon Quick View Extended safe?
DS Amazon Quick View is medium risk. We observed DS Amazon Quick View Extended POST to dmitry.artamoshkin.com during license validation. The body's license_key field was undefined here; the code populates it from the value passed into the Gumroad license verifier.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
License key sent during validation
We observed DS Amazon Quick View Extended POST to dmitry.artamoshkin.com during license validation.
The body's license_key field was undefined here; the code populates it from the value passed into the Gumroad license verifier.
You use a premium feature path that causes the extension to validate its license state.
The extension sends a license_key field to dmitry.artamoshkin.com and updates open tabs with license state.
| Field | Value | Why it matters | |
|---|---|---|---|
License key field | license_key=undefined | The value used to validate the extension license. If a real key is saved, it can identify the license or subscription tied to you. | |
Cached license record | gumroad.key | This lets the extension remember whether the same saved key was recently accepted. | |
License state broadcast | license: "ok" | Open extension content scripts receive whether premium functionality is active. |
license_key=undefined
License validation and tab state broadcast in shipped code
var Gumroad = function() {
var e = "",
r = 0,
t = "",
o = {},
n = function(e) {
chrome.storage.local.get("gumroad", (function(e) {
e.gumroad && (r = e.gumroad.ts, o = e.gumroad.res, t = e.gumroad.key)
}))
},
a = function(r) {
return new Promise((function(t, o) {
r || o({
error: !0,
data: "No license key specified"
}), e || o({
error: !0,
data: "Empty product id"
});
fetch("https://dmitry.artamoshkin.com/ds/license.php", {
method: "POST",
mode: "cors",
body: new URLSearchParams({
license_key: r
})
}).then((function(e) {
if (!e.ok) throw e;
return e
})).then((function(e) {
return e.text()
})).then((function(e) {
console.log(e);
try {
json = JSON.parse(e)
} catch (e) {
json = response
}
var o = s(json, r);
t(o)
})).catch((function(e) {
if ("object" == typeof e && e.message) o({
error: !0,
data: e.message
});
else if ("object" == typeof e && e.status) {
var r = {
error: !0,
data: "Error: " + e.status + " " + e.statusText
};
o(r)
}
}))
}))
},
s = function(e, n) {
if (!e.success) return {
error: !0,
data: e.message
};
var a = {
error: !1,
data: e
};
return function(e, n) {
r = Date.now(), o = n, t = e, chrome.storage.local.set({
gumroad: {
ts: r,
res: o,
key: t
}
})
}(n, a), a
};
return {
init: function(r) {
r.productId && (e = r.productId), n()
},
get: function(e) {
return Date.now() - r < 1728e5 && e === t ? Promise.resolve(o) : a(e)
},
verify: a
}
}(); u = function() {
chrome.tabs.query({}, (function(t) {
for (var i = 0, a = t.length; i < a; i++) chrome.tabs.sendMessage(t[i].id, {
cmd: "app.update_state",
data: {
state: e,
license: r,
settings: n
}
}, (function(e) {}))
}))
},- dmitry.artamoshkin.com
Receives the license validation POST for DS Amazon Quick View Extended.