Is LoadHunter safe?
LoadHunter sends supported factoring-site cookies, login tokens, and form credentials to api.loadhunter.io.
On supported factoring login sites, LoadHunter reads ASP.NET session cookies, login form tokens, and related credential fields used during the factoring-connection flow. It also captures Compass login API tokens and sends these values to LoadHunter's auth endpoint.
Who publishes itloadhunt - no other listings under this identity, 4 shared hostnames
loadhunt - no other listings under this identity, 4 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 4 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Factoring session tokens are sent to LoadHunter
LoadHunter's content script reads provider login fields or API tokens, asks the service worker for the provider session cookie when needed, and sends these to auth.php as saveFactoring data.
No request body was captured for this claim.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You connect a supported factoring account through LoadHunter.
The code gates this flow on provider domains such as Capital Depot, JD Factors, Partners Funding, Compass, and Compass New.
The extension packages provider session data and sends it to LoadHunter.
For ASP.NET providers it combines form-state fields with the provider session cookie; for Compass providers it forwards login tokens from API responses.
- Request typeendpoint: saveFactoring
This tells LoadHunter that the request is saving a connected factoring account.
- LoadHunter accountusername: dispatcher@example.com (illustrative)
This links the factoring connection data to your LoadHunter account.
- LoadHunter session tokentoken: ldp_9d6f0f2a7c4b41e8 (illustrative)
This authenticates the save request to LoadHunter for your account.
- Factoring providerfactoringName: capitalDepot
This identifies which factoring service you connected.
- Provider session cookiefactoringToken: ASP.NET_SessionId=4E1C8F7B6A2D4C1D9F0B (illustrative)
This can represent an active signed-in session with the factoring provider.
- ASP.NET page-state fieldsfactoringOtherCredentialsData.viewState: /wEPDwUKMTY4MzY0NTQ5Nw== (illustrative)
These values come from the factoring provider's login page and can carry session-specific state.
- Compass login tokenfactoringOtherCredentialsData.jwtToken: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 (illustrative)
This is a provider-issued login token captured from a Compass login response.
Code path that reads factoring session data and posts it to LoadHunter
Readable saveFactoring flow derived from the shipped bundle
assets/content-scripts-mGEQZnRU.jsasync function saveFactoring({ username, sessionToken, factoringName, factoringToken, factoringOtherCredentialsData }) { return await authRequest({ endpoint: "saveFactoring", username, token: sessionToken, factoringName, factoringToken, factoringOtherCredentialsData, });}async function connectCapitalDepot() { const providerUrl = "https://clientlogin.winfactor.com"; const targetPage = `${providerUrl}/corporate-search/`; if (!document.body || !window.location.href.includes(providerUrl)) return; chrome.storage.local.get(["lh-factoring-connection-status", "ldpSessionToken", "ldpEmail"]).then((state) => { if (state["lh-factoring-connection-status"].factoring !== factoringNames.capitalDepot) return; if (state["lh-factoring-connection-status"].status !== "inProcess") return; if (window.location.href === `${providerUrl}/`) window.open(targetPage, "_self"); if (window.location.href !== targetPage) return; const form = document.querySelector("#aspnetForm"); const viewState = document.querySelector('input[name="__VIEWSTATE"]'); const viewStateGenerator = document.querySelector('input[name="__VIEWSTATEGENERATOR"]'); const eventValidation = document.querySelector('input[name="__EVENTVALIDATION"]'); if (!form || !viewState || !viewStateGenerator || !eventValidation) return; const otherCredentials = { viewState: viewState.value, viewStateGenerator: viewStateGenerator.value, eventValidation: eventValidation.value, }; chrome.runtime.sendMessage({ type: "getFactoringCookies", url: providerUrl, name: "ASP.NET_SessionId" }).then(async (cookieResult) => { await saveFactoring({ username: state.ldpEmail, sessionToken: state.ldpSessionToken, factoringName: factoringNames.capitalDepot, factoringToken: cookieResult.response, factoringOtherCredentialsData: otherCredentials, }); }); });}Readable Compass token flow derived from the shipped bundle
assets/content-scripts-mGEQZnRU.jsfunction connectCompass() { if (!document.body || !window.location.href.includes("https://compassfs.net")) return; window.addEventListener("message", (event) => { if (event.data.type !== "COMPASS_LOGIN") return; const token = JSON.parse(event.data.data).Token; if (token) submitCompassToken(token); }); function submitCompassToken(token) { chrome.storage.local.get(["lh-factoring-connection-status", "ldpSessionToken", "ldpEmail"]).then(async (state) => { if (state["lh-factoring-connection-status"]?.factoring !== factoringNames.compass) return; if (state["lh-factoring-connection-status"]?.status !== "inProcess") return; await saveFactoring({ username: state.ldpEmail, sessionToken: state.ldpSessionToken, factoringName: factoringNames.compass, factoringToken: token, factoringOtherCredentialsData: {}, }); }); }}function connectCompassNew() { if (!document.body || !window.location.href.includes("https://cfs.compassstore.net")) return; window.addEventListener("message", (event) => { if (event.data.type !== "COMPASS_NEW_LOGIN") return; const token = JSON.parse(event.data.data)?.token; if (token) submitCompassNewToken(token); }); function submitCompassNewToken(token) { chrome.storage.local.get(["lh-factoring-connection-status", "ldpSessionToken", "ldpEmail"]).then(async (state) => { if (state["lh-factoring-connection-status"]?.factoring !== factoringNames.compassNew) return; if (state["lh-factoring-connection-status"]?.status !== "inProcess") return; await saveFactoring({ username: state.ldpEmail, sessionToken: state.ldpSessionToken, factoringName: factoringNames.compassNew, factoringToken: factoringNames.compassNew, factoringOtherCredentialsData: { jwtToken: token }, }); }); }}Readable cookie and POST helpers derived from the shipped bundle
assets/src/entries/background/main-v48RYoot.js and assets/trialDays-DiveLHDL.jschrome.runtime.onMessage.addListener((message, sender, sendResponse) => { if (message.type === "getFactoringCookies" && message.url && message.name) { chrome.cookies.get({ url: message.url, name: message.name }).then((cookie) => { chrome.storage.local.set({ factoring_token: cookie?.value }); sendResponse({ response: cookie?.value }); }).catch((error) => { sendResponse({ error: error.message }); }); }});const apiBase = "https://api.loadhunter.io/";const authRequest = async (payload, skipSessionReset = false) => { try { const response = await (await fetch(apiBase + "auth.php", { method: "POST", body: JSON.stringify(payload), })).json(); return response; } catch { console.log(`Error in authRequest endpoint: ${payload?.endpoint}`); return null; }};- api.loadhunter.io
Receives the saveFactoring POST containing the provider factoring token data and LoadHunter account context.
- clientlogin.winfactor.com
Provider page where the code reads ASP.NET state fields and requests ASP.NET_SessionId for Capital Depot.
- usweb.jdfactors.com
- clientlogin.partnersfundinginc.com
Supported ASP.NET factoring provider domain handled by the same connection pattern.
- compassfs.net
Compass provider domain where login responses are read for the Token value.
- cfs.compassstore.net
Compass New provider domain where login responses are read for the token value.
Where it sends data
Destinations our analysis observed LoadHunter contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- api.loadhunter.io
LoadHunter sends data to api.loadhunter.io. No other extension we have analysed sends data here.