Is Oalur - Amazon Products&Traffic Research Tool safe?
Oalur - Amazon Products&Traffic Research Tool is medium risk. On every Amazon page, this extension sends the page URL and title to a Google Analytics 4 property the vendor (oalur) controls. Confirmed: repeated POSTs to GA's endpoint carried the live URL, title, and per-install UUID.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Amazon page URLs and titles sent to the vendor's Google Analytics on every load
On every Amazon page, this extension sends the page URL and title to a Google Analytics 4 property the vendor (oalur) controls.
Confirmed: repeated POSTs to GA's endpoint carried the live URL, title, and per-install UUID.
You open an Amazon search results or product page.
The content script fires on the window load event for the page.
The extension sends the page's full URL and title to the vendor's Google Analytics property.
A GA4 page_view event is POSTed with the Amazon URL in page_location and the page title in page_title.
| Content-Type | application/json |
{
"client_id": "9cdefa578c754a90845042cf13df6212",
"events": [
{
"name": "page_view",
"params": {
"page_title": "Amazon.com : wireless mouse",
"page_location": "https://www.amazon.com/s?k=wireless+mouse",
"session_id": "...",
"engagement_time_msec": 100
}
}
]
}| Field | Value | Why it matters | |
|---|---|---|---|
Page address | https://www.amazon.com/s?k=wireless+mouse | The full Amazon URL you are viewing, including search keywords and product identifiers. | |
Page title | Amazon.com : wireless mouse | The title of the Amazon page, which often restates your search or the product name. | |
Install identifier | 9cdefa578c754a90845042cf13df6212 | A randomly generated ID stored on your device that stays the same across visits, letting separate page views be linked to the same browser. |
Content script captures the URL/title; service worker POSTs it to GA4
window.addEventListener("load", () => {
sendMessage({
type: "ga",
options: { type: "load", title: document.title, href: document.location.href }
});
});const GA_COLLECT = "https://www.google-analytics.com/mp/collect";
const MEASUREMENT_ID = "G-6J37B091KZ";
const API_SECRET = "<redacted>";
async fireEvent(name, params = {}) {
params.session_id ||= await this.getOrCreateSessionId();
params.engagement_time_msec ||= 100;
await fetch(`${GA_COLLECT}?measurement_id=${MEASUREMENT_ID}&api_secret=${API_SECRET}`, {
method: "POST",
body: JSON.stringify({
client_id: await this.getOrCreateClientId(),
events: [{ name, params }]
})
});
}
firePageViewEvent(title, href) {
return this.fireEvent("page_view", { page_title: title, page_location: href });
}
async getOrCreateClientId() {
let { clientId } = await chrome.storage.local.get("clientId");
if (!clientId) {
clientId = self.crypto.randomUUID();
await chrome.storage.local.set({ clientId });
}
return clientId;
}A random ID generated once, kept on your device, attached to every page_view sent to the vendor's analytics so visits link over time.
chrome.storage.local key 'clientId'{ "clientId": "9cdefa578c754a90845042cf13df6212" }- www.google-analytics.com
Receives GA4 page_view events (Amazon URL + title) under the vendor-controlled property G-6J37B091KZ via the Measurement Protocol endpoint.
Affiliate tracking redirect for 1688.com added on install without notice
On install/update, this extension adds a rule rewriting order URLs on 1688.com to add oalur's affiliate ID.
Confirmed: a fresh install's rules showed one rule adding extId=oalur to checkout URLs. 1688.com isn't in the declared permissions.
You install or update the extension, then later open an order page on 1688.com.
The redirect rule is registered once at install time and applies to every matching order URL afterward.
The browser rewrites the order URL to add an affiliate identifier crediting oalur for the purchase.
An extId parameter carrying the oalur affiliate code is appended to order.1688.com checkout URLs.
The redirect rule registered from the install handler
chrome.runtime.onInstalled.addListener((details) => {
const { reason } = details;
if (reason === "update") onUpdate(details);
else if (reason === "install") onInstall(details);
chrome.declarativeNetRequest.updateDynamicRules({
addRules: [{
id: 1,
priority: 1,
condition: {
regexFilter: "order\\.1688\\.com/order/smart_make_order\\.htm\\?.*(p|fromkv)=.*",
resourceTypes: ["main_frame", "sub_frame"],
initiatorDomains: ["1688.com"]
},
action: {
type: "redirect",
redirect: {
transform: {
queryTransform: {
addOrReplaceParams: [{
key: "extId",
value: '{"verticalAttributesMap":{"_F_b_kj_dc":"oalur"}}'
}]
}
}
}
}
}]
});
});| Field | Value | Why it matters | |
|---|---|---|---|
Pages it rewrites | order.1688.com/order/smart_make_order.htm?p=... | Checkout/order URLs on the 1688.com wholesale marketplace. | |
Parameter added | extId={"verticalAttributesMap":{"_F_b_kj_dc":"oalur"}} | A new query parameter is appended to the order URL. | |
Affiliate credited | oalur | The identifier embedded in the parameter attributes the purchase to oalur. |
Paste into the extension's service-worker DevTools console to list the dynamic network rules the extension has registered and flag the 1688.com affiliate redirect rule.
// Run in the extension's service-worker console (chrome://extensions -> Inspect service worker).
chrome.declarativeNetRequest.getDynamicRules().then((rules) => {
console.log(`Extension has ${rules.length} dynamic rule(s):`);
for (const r of rules) {
console.log(JSON.stringify(r, null, 2));
const rf = r.condition && r.condition.regexFilter;
const params = r.action && r.action.redirect && r.action.redirect.transform
&& r.action.redirect.transform.queryTransform
&& r.action.redirect.transform.queryTransform.addOrReplaceParams;
if (rf && rf.includes('1688.com') && params) {
console.warn('Affiliate redirect rule present:',
params.map((p) => `${p.key}=${p.value}`).join(', '));
}
}
});- 1Open chrome://extensions, enable Developer mode.
- 2Find this extension, click 'Inspect views: service worker'.
- 3Paste the script into Console, press Enter.
- 4Check the printed rules for the 1688.com affiliate-redirect warning.