Is Poshmark Bot Sharer by Flyp safe?
Poshmark Bot Sharer by Flyp transmits Poshmark user IDs and API request URLs to Sentry's error-tracking servers.
The extension initializes the Sentry Browser SDK with a hardcoded DSN and a tracesSampleRate of 1.0, meaning all performance spans and every outbound HTTP call are captured as breadcrumbs. Because Poshmark API URLs embed user identifiers, these are included in the breadcrumb trail and sent to o1271039.ingest.sentry.io whenever an error or performance event is reported. Additionally, the extension hardcodes a static XSRF token used across all installations when submitting CAPTCHA responses to Poshmark.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Static XSRF token in Poshmark CAPTCHA API calls
Poshmark Bot Sharer by Flyp has two CAPTCHA-solving paths that POST to Poshmark's recaptcha endpoint with the same x-xsrf-token.
The body holds the challenged action, user ID, and CAPTCHA response.
No body captured; fields come from source.
You run a Poshmark sharing or following workflow that reaches a CAPTCHA challenge.
The extension submits the CAPTCHA response with a bundled XSRF request header.
Both shipped CAPTCHA implementations use the same header value instead of deriving it inside the function from your current browser session.
| Field | Value | Why it matters | |
|---|---|---|---|
XSRF header token | n7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w | Uses one bundled request token instead of a value created for your current browser session. | |
Challenged action | share_post | Tells Poshmark which automated action reached the CAPTCHA challenge, such as sharing a listing or following a user. | |
Poshmark account ID | 1234567890 (illustrative) | Associates the CAPTCHA response with your Poshmark account in the submitted request. |
| accept | application/json |
| content-type | application/json |
| x-xsrf-token | n7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w |
| cache-control | no-cache |
Both CAPTCHA implementations send the same static XSRF header
async function applyCaptchaSolutionRest(restrictedAction, captchaResponse, userId) {
const headers = new Headers({
accept: "application/json",
"cache-control": "no-cache",
"content-type": "application/json",
"x-xsrf-token": "n7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w"
});
try {
const response = await fetch("https://poshmark.com/vm-rest/responses/recaptcha?pm_version=161.0.0", {
method: "POST",
body: JSON.stringify({
restricted_action: restrictedAction,
user_id: userId,
g_recaptcha_response: captchaResponse
}),
headers
});
const jsonResponse = await response.json();
return jsonResponse.success;
} catch (error) {
return false;
}
}async function applyCaptchaSolutionRest(restrictedAction, captchaResponse, userId) {
const headers = new Headers({
accept: "application/json",
"cache-control": "no-cache",
"content-type": "application/json",
"x-xsrf-token": "n7o7zvMM-RBzEnez--p4AKnbSvZa0D-z253w",
});
try {
const response = await fetch("https://poshmark.com/vm-rest/responses/recaptcha?pm_version=161.0.0", {
method: "POST",
body: JSON.stringify({
restricted_action: restrictedAction,
user_id: userId,
g_recaptcha_response: captchaResponse,
}),
headers,
});
const jsonResponse = await response.json();
return jsonResponse.success;
} catch (error) {
notifyError(error);
console.log(`Failed apply captcha solution REST to poshmark. error: ${error.message}`);
return false;
}
}- poshmark.com
Receives the recaptcha response POST with the bundled x-xsrf-token header.
- 2captcha.com
Receives CAPTCHA-solving requests when a 2Captcha key is configured.
- api.anti-captcha.com
Receives CAPTCHA-solving requests when an Anti-Captcha key is configured.