Is LinkMatch for Close safe?
LinkMatch for Close copies LinkedIn profiles you view and uploads them to its servers, and scrapes profiles on server request.
On LinkedIn and Xing pages, the extension hooks the site's own API calls and sends the parsed profiles, with your email, to app2.linkmatch.com. On each LinkedIn page load it also fetches a list of profile identifiers from the same server, loads each one using your LinkedIn session (including contact info and company), and reports the results back, without a prompt.
Who publishes itLogical Pure Minds SRL - 9 other listings from the same operator, 6 of them carrying a finding
Logical Pure Minds SRL - 9 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
9 other listings published from this account, 12k+ users between them. 6 of them carry a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
LinkMatch uploads LinkedIn profiles you view to app2.linkmatch.com
Code analysis shows LinkedIn API responses are relayed to a content script, which posts parsed profile data and your account email to app2.linkmatch.com.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open a LinkedIn profile, inbox or Sales Navigator page.
The extension copies the page's LinkedIn API responses and uploads parsed profile data to app2.linkmatch.com.
Messages are blanked before upload; your email is attached.
Response relay and receiving listener
Listener, no origin check
content-script-bundle.jsconst e = r => { if (r.data?.type === "REQ_RESPONSE") { const i = r.data; G7e(i.url, i.response, i.request) }};window.addEventListener("message", e, !1)Upload endpoint
content-script-bundle.jssave_linkedin_profile: e => Ya(`${Ta.linkmatch_host2}/api/slp`, { data: Si(e)}, "application/json")- Your emailuser@example.com (illustrative)
Identifies which extension user uploaded the record.
- Profile identifierln_identifier: jane-doe-12345 (illustrative)
Which LinkedIn profile was viewed.
- Parsed profileprofile_fields.background_experience[...]
Profile fields parsed from LinkedIn responses; messages set to an empty list.
- App versionapp_version: 4.87
Extension build reporting the record.
- app2.linkmatch.com
Receives /api/slp (profiles), /api/scd and /api/slc (companies), /api/sdu (decoded urls).
Behavior is read from source. The extension's LinkedIn and XING content scripts run only on those sites. The listener has no origin check on window messages.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
LinkMatch fetches server-chosen LinkedIn profiles using your session
Code analysis shows the extension pulls a profile list from app2.linkmatch.com on LinkedIn page load, fetches each with your login, and reports results back.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Static analysis
You load any LinkedIn page while signed in.
The extension asks app2.linkmatch.com for profile identifiers, fetches each as you, and uploads the results.
Contact info and current company are included in the requested sections.
Task pull, fetch and report
Invoked at content-script init
content-script-bundle.jsIc(1, "fetchCUPDTasks", () => zDe(I))()Per-task profile fetch (excerpt)
content-script-bundle.jsPromise.all(r.map(o => e.ui_helper.get_json_person_data({ primary: o.socialIdentifier}, { inIframe: !0, lang: "en", sectionsToInclude: ["followers", "non_std_urls", "resume", "contactInfo"], initiator: "profile_parse"})- Your emailworkerId: user@example.com (illustrative)
Sent as the worker identifier on pull and report.
- Target profilesocialIdentifier: jane-doe-12345 (illustrative)
Identifier supplied by the server for you to fetch.
- Profile datadata: {exists: true, profile_fields: ...}
Fetched profile including contact info, returned to the server.
- Company datadata_company: {exists: true, ...}
Current employer profile fetched alongside.
- app2.linkmatch.com
Supplies targets via /worker-tasks/pull and receives results at /worker-tasks/report.
The task list depends on the server response, which we did not observe. The code path runs without a user prompt when the UI is not initiated.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed LinkMatch for Close contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- app2.linkmatch.com
LinkMatch for Close sends data to app2.linkmatch.com. 6 other extensions we have analysed send data here.