Is Poshmark Bot Sharer by Flyp safe?
Poshmark Bot Sharer by Flyp transmits Poshmark user IDs and API request URLs to Sentry's error-tracking servers.
The extension initializes the Sentry Browser SDK with a hardcoded DSN and a tracesSampleRate of 1.0, meaning all performance spans and every outbound HTTP call are captured as breadcrumbs. Because Poshmark API URLs embed user identifiers, these are included in the breadcrumb trail and sent to o1271039.ingest.sentry.io whenever an error or performance event is reported. Additionally, the extension hardcodes a static XSRF token used across all installations when submitting CAPTCHA responses to Poshmark.
Who publishes itFlyp - no other listings under this identity
Flyp - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Static XSRF token in Poshmark CAPTCHA API calls
Poshmark Bot Sharer by Flyp has two CAPTCHA-solving paths that POST to Poshmark's recaptcha endpoint with the same x-xsrf-token.
The body holds the challenged action, user ID, and CAPTCHA response.
No body captured; fields come from source.
What actually happens
You run a Poshmark sharing or following workflow that reaches a CAPTCHA challenge.
The extension submits the CAPTCHA response with a bundled XSRF request header.
Both shipped CAPTCHA implementations use the same header value instead of deriving it inside the function from your current browser session.
Request fields built by the CAPTCHA submission function
- XSRF header tokenn7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w
Uses one bundled request token instead of a value created for your current browser session.
- Challenged actionshare_post
Tells Poshmark which automated action reached the CAPTCHA challenge, such as sharing a listing or following a user.
- Poshmark account ID1234567890 (illustrative)
Associates the CAPTCHA response with your Poshmark account in the submitted request.
Captured request
The function parses the JSON response and returns the response success flag.
- accept
- application/json
- content-type
- application/json
- x-xsrf-token
- n7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w
- cache-control
- no-cache
The code that does this
Both CAPTCHA implementations send the same static XSRF header
v2 CAPTCHA submission path
background.jsasync function applyCaptchaSolutionRest(restrictedAction, captchaResponse, userId) { const headers = new Headers({ accept: "application/json", "cache-control": "no-cache", "content-type": "application/json", "x-xsrf-token": "n7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w" }); try { const response = await fetch("https://poshmark.com/vm-rest/responses/recaptcha?pm_version=161.0.0", { method: "POST", body: JSON.stringify({ restricted_action: restrictedAction, user_id: userId, g_recaptcha_response: captchaResponse }), headers }); const jsonResponse = await response.json(); return jsonResponse.success; } catch (error) { return false; }}older bot-detection submission path
background.jsasync function applyCaptchaSolutionRest(restrictedAction, captchaResponse, userId) { const headers = new Headers({ accept: "application/json", "cache-control": "no-cache", "content-type": "application/json", "x-xsrf-token": "n7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w", }); try { const response = await fetch("https://poshmark.com/vm-rest/responses/recaptcha?pm_version=161.0.0", { method: "POST", body: JSON.stringify({ restricted_action: restrictedAction, user_id: userId, g_recaptcha_response: captchaResponse, }), headers, }); const jsonResponse = await response.json(); return jsonResponse.success; } catch (error) { notifyError(error); console.log(`Failed apply captcha solution REST to poshmark. error: ${error.message}`); return false; }}Hosts involved in the CAPTCHA-solving flow
- poshmark.com
Receives the recaptcha response POST with the bundled x-xsrf-token header.
- 2captcha.com
Receives CAPTCHA-solving requests when a 2Captcha key is configured.
- api.anti-captcha.com
Receives CAPTCHA-solving requests when an Anti-Captcha key is configured.
Where it sends data
Destinations our analysis observed Poshmark Bot Sharer by Flyp contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- o1271039.ingest.sentry.io
Poshmark Bot Sharer by Flyp sends data to o1271039.ingest.sentry.io. No other extension we have analyzed sends data here.