Is PoshPop | Poshmark Closet Bot safe?

Question

Accepted Answer

PoshPop | Poshmark Closet Bot is high risk. When you use PoshPop sharing actions, the extension builds Poshmark API requests whose headers include your page cookies. If one of those requests fails in the handled error path, the error logger can copy the request headers into an extension log message and post it to the remote PoshPop iframe at https://poshpoptools.com/. When you are signed in and uninstall PoshPop, the extension configures Chrome to open a Tally feedback URL that includes your authenticated email address. The recorded endpoint is tally.so/r/mOPMZg, and the evidence shows the email is appended as a user_email query parameter.

Is PoshPop | Poshmark Closet Bot safe?

Findings