Marter is published by Earbe LLC, registered at 8 The Green, Dover, DE 19901, US. The same operator publishes 3 other store listings, none of which carry a security finding.

What servers does Marter send data to?

Our analysis observed Marter sending data to script.google.com.

Is Marter safe?

Q: Is Marter safe?

Marter is medium risk. Choosing Download Buy List makes Marter export the buy-list CSV and also POST the same CSV to a Google Apps Script endpoint. Data includes stored buy-list product details: pricing, identifiers, source, notes, quantities, dimensions, dates.

Medium risk

Marter sends Download Buy List CSV exports to a hardcoded Google Apps Script endpoint.

When a user chooses Download Buy List, Marter builds a CSV from the saved buy list and opens a local download. The same CSV, including item IDs, UPCs, prices, fees, profit, ROI, quantities, notes, source, and dates, is also POSTed to a Google Apps Script URL.

getmarter.comv2.51.8Chrome Web Store

45Risk

Who publishes it

Earbe LLC - 3 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

getmarter.com

Declared legal entity

Earbe LLC

Registered address

8 The Green, Dover, DE 19901, US

Registered contact

Get Marter

Website

www.getmarter.com/

Same operator - 3 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

3 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Download Buy List sends saved CSV data to Google Apps Script.

Choosing Download Buy List makes Marter export the buy-list CSV and also POST the same CSV to a Google Apps Script endpoint.

Data includes stored buy-list product details: pricing, identifiers, source, notes, quantities, dimensions, dates.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-359
Source: Dynamic sandbox

What actually happens

You did this

You choose Download Buy List.

The extension did this

The extension creates a local CSV export and also POSTs the same buy-list CSV content to a Google Apps Script endpoint.

Captured request

POSThttps://script.google.com/macros/s/AKfycbyWHo9rYI6dcbkIzt2h006NBD6Lh6epZnKCA2IMEMANjHklaUPIZlqxCAkM5NQIEXSb/exec

Fields in the request

Saved buy-list CSV data
Name,Walmart Id,UPC,Cost Price,Sale Price,Quantity,Notes (illustrative)
Buy-list rows saved by the extension: product identifiers, pricing, fees, quantities, dimensions, source, notes, origin, dates.
Product URL context
https://www.walmart.com/ip/123456789 (illustrative)
URLs can identify which product pages or sources are associated with the exported buy-list rows.

Observation

Dynamic analysis confirmed that the Download Buy List action is wired to the CSV export path that posts the buy-list content to the Google Apps Script endpoint.

Where it sends data

Destinations our analysis observed Marter contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

script.google.com
Marter sends data to script.google.com. 12 other extensions we have analysed send data here.