Is Poshmark Bot Sharer by Flyp safe?

Medium risk

Poshmark Bot Sharer by Flyp transmits Poshmark user IDs and API request URLs to Sentry's error-tracking servers.

The extension initializes the Sentry Browser SDK with a hardcoded DSN and a tracesSampleRate of 1.0, meaning all performance spans and every outbound HTTP call are captured as breadcrumbs. Because Poshmark API URLs embed user identifiers, these are included in the breadcrumb trail and sent to o1271039.ingest.sentry.io whenever an error or performance event is reported. Additionally, the extension hardcodes a static XSRF token used across all installations when submitting CAPTCHA responses to Poshmark.

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-522
SourceAI SANDBOX

Static XSRF token in Poshmark CAPTCHA API calls

Poshmark Bot Sharer by Flyp has two CAPTCHA-solving paths that POST to Poshmark's recaptcha endpoint with the same x-xsrf-token.

The body holds the challenged action, user ID, and CAPTCHA response.

No body captured; fields come from source.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You run a Poshmark sharing or following workflow that reaches a CAPTCHA challenge.

The extension did this

The extension submits the CAPTCHA response with a bundled XSRF request header.

Both shipped CAPTCHA implementations use the same header value instead of deriving it inside the function from your current browser session.

02EvidenceFIELD TABLE
Request fields built by the CAPTCHA submission function
FieldValueWhy it matters
XSRF header token
n7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253wUses one bundled request token instead of a value created for your current browser session.
Challenged action
share_postTells Poshmark which automated action reached the CAPTCHA challenge, such as sharing a listing or following a user.
Poshmark account ID
1234567890 (illustrative)Associates the CAPTCHA response with your Poshmark account in the submitted request.
03EvidenceNETWORK CAPTURE
Captured request
POSThttps://poshmark.com/vm-rest/responses/recaptcha?pm_version=161.0.0
The function parses the JSON response and returns the response success flag.
Headers
acceptapplication/json
content-typeapplication/json
x-xsrf-tokenn7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w
cache-controlno-cache
04EvidenceCODE COMPARE
The code that does this

Both CAPTCHA implementations send the same static XSRF header

What it actually does
v2 CAPTCHA submission pathbackground.js
async function applyCaptchaSolutionRest(restrictedAction, captchaResponse, userId) {
  const headers = new Headers({
    accept: "application/json",
    "cache-control": "no-cache",
    "content-type": "application/json",
    "x-xsrf-token": "n7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w"
  });

  try {
    const response = await fetch("https://poshmark.com/vm-rest/responses/recaptcha?pm_version=161.0.0", {
      method: "POST",
      body: JSON.stringify({
        restricted_action: restrictedAction,
        user_id: userId,
        g_recaptcha_response: captchaResponse
      }),
      headers
    });
    const jsonResponse = await response.json();
    return jsonResponse.success;
  } catch (error) {
    return false;
  }
}
older bot-detection submission pathbackground.js
async function applyCaptchaSolutionRest(restrictedAction, captchaResponse, userId) {
  const headers = new Headers({
    accept: "application/json",
    "cache-control": "no-cache",
    "content-type": "application/json",
    "x-xsrf-token": "n7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w",
  });
  try {
    const response = await fetch("https://poshmark.com/vm-rest/responses/recaptcha?pm_version=161.0.0", {
      method: "POST",
      body: JSON.stringify({
        restricted_action: restrictedAction,
        user_id: userId,
        g_recaptcha_response: captchaResponse,
      }),
      headers,
    });
    const jsonResponse = await response.json();
    return jsonResponse.success;
  } catch (error) {
    notifyError(error);
    console.log(`Failed apply captcha solution REST to poshmark. error: ${error.message}`);
    return false;
  }
}
05EvidenceTHIRD PARTY LIST
Hosts involved in the CAPTCHA-solving flow
  • poshmark.com

    Receives the recaptcha response POST with the bundled x-xsrf-token header.

  • 2captcha.com

    Receives CAPTCHA-solving requests when a 2Captcha key is configured.

  • api.anti-captcha.com

    Receives CAPTCHA-solving requests when an Anti-Captcha key is configured.

Data recipients

o1271039.ingest.sentry.io
Updated 17 September 2026ehicjmkogfjifombjmdinmhpaghfggcd