Is Oalur - Amazon Products&Traffic Research Tool safe?

Medium risk

Oalur - Amazon Products&Traffic Research Tool is medium risk. On every Amazon page, this extension sends the page URL and title to a Google Analytics 4 property the vendor (oalur) controls. Confirmed: repeated POSTs to GA's endpoint carried the live URL, title, and per-install UUID.…

itsupportv1.9.4.7Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Amazon page URLs and titles sent to the vendor's Google Analytics on every load

On every Amazon page, this extension sends the page URL and title to a Google Analytics 4 property the vendor (oalur) controls.

Confirmed: repeated POSTs to GA's endpoint carried the live URL, title, and per-install UUID.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open an Amazon search results or product page.

The content script fires on the window load event for the page.

The extension did this

The extension sends the page's full URL and title to the vendor's Google Analytics property.

A GA4 page_view event is POSTed with the Amazon URL in page_location and the page title in page_title.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-6J37B091KZ&api_secret=<redacted>
Captured 10+ such POSTs across two dynamic-analysis sessions; each body carried the visited Amazon URL in page_location. A second example carried page_location=https://www.amazon.com/s?k=headphones. The api_secret value is redacted here.
Headers
Content-Typeapplication/json
Body
{
  "client_id": "9cdefa578c754a90845042cf13df6212",
  "events": [
    {
      "name": "page_view",
      "params": {
        "page_title": "Amazon.com : wireless mouse",
        "page_location": "https://www.amazon.com/s?k=wireless+mouse",
        "session_id": "...",
        "engagement_time_msec": 100
      }
    }
  ]
}
03EvidenceFIELD TABLE
What each page_view event carries
FieldValueWhy it matters
Page address
https://www.amazon.com/s?k=wireless+mouseThe full Amazon URL you are viewing, including search keywords and product identifiers.
Page title
Amazon.com : wireless mouseThe title of the Amazon page, which often restates your search or the product name.
Install identifier
9cdefa578c754a90845042cf13df6212A randomly generated ID stored on your device that stays the same across visits, letting separate page views be linked to the same browser.
04EvidenceCODE COMPARE
The code that does this

Content script captures the URL/title; service worker POSTs it to GA4

What it actually does
content/main.js — reads title + href on load
window.addEventListener("load", () => {
  sendMessage({
    type: "ga",
    options: { type: "load", title: document.title, href: document.location.href }
  });
});
background.js — sends GA4 page_view
const GA_COLLECT = "https://www.google-analytics.com/mp/collect";
const MEASUREMENT_ID = "G-6J37B091KZ";
const API_SECRET = "<redacted>";

async fireEvent(name, params = {}) {
  params.session_id ||= await this.getOrCreateSessionId();
  params.engagement_time_msec ||= 100;
  await fetch(`${GA_COLLECT}?measurement_id=${MEASUREMENT_ID}&api_secret=${API_SECRET}`, {
    method: "POST",
    body: JSON.stringify({
      client_id: await this.getOrCreateClientId(),
      events: [{ name, params }]
    })
  });
}

firePageViewEvent(title, href) {
  return this.fireEvent("page_view", { page_title: title, page_location: href });
}

async getOrCreateClientId() {
  let { clientId } = await chrome.storage.local.get("clientId");
  if (!clientId) {
    clientId = self.crypto.randomUUID();
    await chrome.storage.local.set({ clientId });
  }
  return clientId;
}
05EvidenceSTORAGE DUMP
What's stored on your device

A random ID generated once, kept on your device, attached to every page_view sent to the vendor's analytics so visits link over time.

Locationchrome.storage.local key 'clientId'
Contents
{ "clientId": "9cdefa578c754a90845042cf13df6212" }
06EvidenceTHIRD PARTY LIST
Where the page data is sent
  • www.google-analytics.com

    Receives GA4 page_view events (Amazon URL + title) under the vendor-controlled property G-6J37B091KZ via the Measurement Protocol endpoint.

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-506
SourceAI SANDBOX

Affiliate tracking redirect for 1688.com added on install without notice

On install/update, this extension adds a rule rewriting order URLs on 1688.com to add oalur's affiliate ID.

Confirmed: a fresh install's rules showed one rule adding extId=oalur to checkout URLs. 1688.com isn't in the declared permissions.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install or update the extension, then later open an order page on 1688.com.

The redirect rule is registered once at install time and applies to every matching order URL afterward.

The extension did this

The browser rewrites the order URL to add an affiliate identifier crediting oalur for the purchase.

An extId parameter carrying the oalur affiliate code is appended to order.1688.com checkout URLs.

02EvidenceCODE COMPARE
The code that does this

The redirect rule registered from the install handler

What it actually does
chrome.runtime.onInstalled.addListener((details) => {
  const { reason } = details;
  if (reason === "update") onUpdate(details);
  else if (reason === "install") onInstall(details);

  chrome.declarativeNetRequest.updateDynamicRules({
    addRules: [{
      id: 1,
      priority: 1,
      condition: {
        regexFilter: "order\\.1688\\.com/order/smart_make_order\\.htm\\?.*(p|fromkv)=.*",
        resourceTypes: ["main_frame", "sub_frame"],
        initiatorDomains: ["1688.com"]
      },
      action: {
        type: "redirect",
        redirect: {
          transform: {
            queryTransform: {
              addOrReplaceParams: [{
                key: "extId",
                value: '{"verticalAttributesMap":{"_F_b_kj_dc":"oalur"}}'
              }]
            }
          }
        }
      }
    }]
  });
});
03EvidenceFIELD TABLE
The rule confirmed live from the running extension
FieldValueWhy it matters
Pages it rewrites
order.1688.com/order/smart_make_order.htm?p=...Checkout/order URLs on the 1688.com wholesale marketplace.
Parameter added
extId={"verticalAttributesMap":{"_F_b_kj_dc":"oalur"}}A new query parameter is appended to the order URL.
Affiliate credited
oalurThe identifier embedded in the parameter attributes the purchase to oalur.
04EvidenceARTIFACT
Check if you're affected

Paste into the extension's service-worker DevTools console to list the dynamic network rules the extension has registered and flag the 1688.com affiliate redirect rule.

RequiresChrome with Developer mode enabled
check-oalur-dnr-rule.js · js
// Run in the extension's service-worker console (chrome://extensions -> Inspect service worker).
chrome.declarativeNetRequest.getDynamicRules().then((rules) => {
  console.log(`Extension has ${rules.length} dynamic rule(s):`);
  for (const r of rules) {
    console.log(JSON.stringify(r, null, 2));
    const rf = r.condition && r.condition.regexFilter;
    const params = r.action && r.action.redirect && r.action.redirect.transform
      && r.action.redirect.transform.queryTransform
      && r.action.redirect.transform.queryTransform.addOrReplaceParams;
    if (rf && rf.includes('1688.com') && params) {
      console.warn('Affiliate redirect rule present:',
        params.map((p) => `${p.key}=${p.value}`).join(', '));
    }
  }
});
How to run it
  1. 1
    Open chrome://extensions, enable Developer mode.
  2. 2
    Find this extension, click 'Inspect views: service worker'.
  3. 3
    Paste the script into Console, press Enter.
  4. 4
    Check the printed rules for the 1688.com affiliate-redirect warning.
Updated 17 September 2026fphfjnoofajmjegmgdonaedncbgmbcpm