Is Oalur - Amazon Products&Traffic Research Tool safe?

Medium risk

Oalur - Amazon Products&Traffic Research Tool is medium risk. On every Amazon page, this extension sends the page URL and title to a Google Analytics 4 property the vendor (oalur) controls. Confirmed: repeated POSTs to GA's endpoint carried the live URL, title, and per-install UUID.…

itsupportv1.9.4.7Chrome Web Store
49Risk
Who publishes it

itsupport - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
itsupport

Same store account

1 other listing published from this account, 3k+ users between them, none of them carrying a finding.

Dataso.AI - TikTok Influencer Analytics3k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Amazon page URLs and titles sent to the vendor's Google Analytics on every load

MediumunwantedCWE-359Dynamic sandbox

On every Amazon page, this extension sends the page URL and title to a Google Analytics 4 property the vendor (oalur) controls.

What actually happens

You did this

You open an Amazon search results or product page.

The content script fires on the window load event for the page.

The extension did this

The extension sends the page's full URL and title to the vendor's Google Analytics property.

A GA4 page_view event is POSTed with the Amazon URL in page_location and the page title in page_title.

Captured request

POSThttps://www.google-analytics.com/mp/collect?measurement_id=G-6J37B091KZ&api_secret=<redacted>

Captured 10+ such POSTs across two dynamic-analysis sessions; each body carried the visited Amazon URL in page_location. A second example carried page_location=https://www.amazon.com/s?k=headphones. The api_secret value is redacted here.

Headers
Content-Type
application/json
Body
{  "client_id": "9cdefa578c754a90845042cf13df6212",  "events": [    {      "name": "page_view",      "params": {        "page_title": "Amazon.com : wireless mouse",        "page_location": "https://www.amazon.com/s?k=wireless+mouse",        "session_id": "...",        "engagement_time_msec": 100      }    }  ]}

What each page_view event carries

  • Page address
    https://www.amazon.com/s?k=wireless+mouse

    The full Amazon URL you are viewing, including search keywords and product identifiers.

  • Page title
    Amazon.com : wireless mouse

    The title of the Amazon page, which often restates your search or the product name.

  • Install identifier
    9cdefa578c754a90845042cf13df6212

    A randomly generated ID stored on your device that stays the same across visits, letting separate page views be linked to the same browser.

The code that does this

Content script captures the URL/title; service worker POSTs it to GA4

Readable version

content/main.js — reads title + href on load

window.addEventListener("load", () => {  sendMessage({    type: "ga",    options: { type: "load", title: document.title, href: document.location.href }  });});

background.js — sends GA4 page_view

const GA_COLLECT = "https://www.google-analytics.com/mp/collect";const MEASUREMENT_ID = "G-6J37B091KZ";const API_SECRET = "<redacted>";async fireEvent(name, params = {}) {  params.session_id ||= await this.getOrCreateSessionId();  params.engagement_time_msec ||= 100;  await fetch(`${GA_COLLECT}?measurement_id=${MEASUREMENT_ID}&api_secret=${API_SECRET}`, {    method: "POST",    body: JSON.stringify({      client_id: await this.getOrCreateClientId(),      events: [{ name, params }]    })  });}firePageViewEvent(title, href) {  return this.fireEvent("page_view", { page_title: title, page_location: href });}async getOrCreateClientId() {  let { clientId } = await chrome.storage.local.get("clientId");  if (!clientId) {    clientId = self.crypto.randomUUID();    await chrome.storage.local.set({ clientId });  }  return clientId;}

What's stored on your device

A random ID generated once, kept on your device, attached to every page_view sent to the vendor's analytics so visits link over time.

Location
chrome.storage.local key 'clientId'
Contents
{  "clientId": "9cdefa578c754a90845042cf13df6212"}

Where the page data is sent

    • www.google-analytics.com

    Receives GA4 page_view events (Amazon URL + title) under the vendor-controlled property G-6J37B091KZ via the Measurement Protocol endpoint.

Affiliate tracking redirect for 1688.com added on install without notice

MediumunwantedCWE-506Dynamic sandbox

On install/update, this extension adds a rule rewriting order URLs on 1688.com to add oalur's affiliate ID.

What actually happens

You did this

You install or update the extension, then later open an order page on 1688.com.

The redirect rule is registered once at install time and applies to every matching order URL afterward.

The extension did this

The browser rewrites the order URL to add an affiliate identifier crediting oalur for the purchase.

An extId parameter carrying the oalur affiliate code is appended to order.1688.com checkout URLs.

The code that does this

The redirect rule registered from the install handler

Readable version
chrome.runtime.onInstalled.addListener((details) => {  const { reason } = details;  if (reason === "update") onUpdate(details);  else if (reason === "install") onInstall(details);  chrome.declarativeNetRequest.updateDynamicRules({    addRules: [{      id: 1,      priority: 1,      condition: {        regexFilter: "order\\.1688\\.com/order/smart_make_order\\.htm\\?.*(p|fromkv)=.*",        resourceTypes: ["main_frame", "sub_frame"],        initiatorDomains: ["1688.com"]      },      action: {        type: "redirect",        redirect: {          transform: {            queryTransform: {              addOrReplaceParams: [{                key: "extId",                value: '{"verticalAttributesMap":{"_F_b_kj_dc":"oalur"}}'              }]            }          }        }      }    }]  });});

The rule confirmed live from the running extension

  • Pages it rewrites
    order.1688.com/order/smart_make_order.htm?p=...

    Checkout/order URLs on the 1688.com wholesale marketplace.

  • Parameter added
    extId={"verticalAttributesMap":{"_F_b_kj_dc":"oalur"}}

    A new query parameter is appended to the order URL.

  • Affiliate credited
    oalur

    The identifier embedded in the parameter attributes the purchase to oalur.

Check if you're affected

Paste into the extension's service-worker DevTools console to list the dynamic network rules the extension has registered and flag the 1688.com affiliate redirect rule.

Requires
  • Chrome with Developer mode enabled
check-oalur-dnr-rule.js · js
// Run in the extension's service-worker console (chrome://extensions -> Inspect service worker).chrome.declarativeNetRequest.getDynamicRules().then((rules) => {  console.log(`Extension has ${rules.length} dynamic rule(s):`);  for (const r of rules) {    console.log(JSON.stringify(r, null, 2));    const rf = r.condition && r.condition.regexFilter;    const params = r.action && r.action.redirect && r.action.redirect.transform      && r.action.redirect.transform.queryTransform      && r.action.redirect.transform.queryTransform.addOrReplaceParams;    if (rf && rf.includes('1688.com') && params) {      console.warn('Affiliate redirect rule present:',        params.map((p) => `${p.key}=${p.value}`).join(', '));    }  }});
How to run it
  1. 1Open chrome://extensions, enable Developer mode.
  2. 2Find this extension, click 'Inspect views: service worker'.
  3. 3Paste the script into Console, press Enter.
  4. 4Check the printed rules for the 1688.com affiliate-redirect warning.
Updated 30 September 2026fphfjnoofajmjegmgdonaedncbgmbcpm