Is Prime Party Extended [QVI] safe?

Medium risk

Prime Party Extended [QVI] sends Amazon and Prime Video account details and remotely requested viewing data to its servers.

On Amazon and Prime Video pages, the extension creates a session with me3x.online using account, profile, membership, language, country, and extension-user identifiers. The server can then tell the content script to collect profile details, watch history, video bookmarks, subscriptions, payment-history fields, and contact-page data, which are posted back to me3x.online and metricsmint.quest.

ToopExtv0.44Chrome Web Store
45Risk
Who publishes it

HideApp LLC - 69 other listings from the same operator, 15 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ToopExt
Declared legal entity
HideApp LLC
Registered address
1021 East Lincolnway, Cheyenne, WY 82001, US
Registered contact
HideApp LLC
Website
support.hideapp.info/support/tickets/new

Same store account

6 other listings published from this account, 232k+ users between them. 1 of them carries a finding.

Netflix Picture in Picture200k+MediumAmazon Prime Freevee Skipper: skip ads, intros & more [QVI]30k+LowApple TV Extended: boost your viewing [QVI]1k+LowPicture in Picture works with Paramount [QVI]1k+LowStreaming Skipper – Skip Ads, Intros & Recaps [QVI]102LowExtended works with Paramount Plus [QVI]64Low

Same operator - 63 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

Prime Party
same registered address
60k+Medium
Custom Profile Picture for Netflix
same registered address
200k+Medium
Shorts scroller, works with Youtube [QVI]
same registered contact
30k+Medium
HBO Max Extended: tools to fix HBO [QVI]
same registered contact
4k+Low
Speeder that works with Disney Plus [QVI]
same registered address
40k+Low
HBO Max Party: watch HBO together and chat [QVI]
same registered address
6k+Low57 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Prime Party Extended forces the Amazon remember-me box on without asking

On Amazon and Prime Video sign-in pages, the extension checks the remember-me box for you, or adds an off-screen field that does the same, keeping your session signed in longer than you chose.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open an Amazon or Prime Video sign-in page with the extension installed.

The content script runs at document_start on amazon.com, amazon.co.uk, amazon.de, amazon.co.jp, and primevideo.com.

The extension did this

The extension checks the remember-me box for you, or adds an off-screen field that has the same effect.

This extends how long your Amazon session stays signed in, even if you never touched that setting.

The code that does this

checkRememberCheckbox() in the Amazon/Prime Video content script

Readable version
function checkRememberCheckbox() {    try {        var signInForm = document.querySelectorAll('form[name="signIn"]');        signInForm.forEach(function(form) {            var rememberMeInput = form.querySelector('input[name="rememberMe"]');            if (rememberMeInput) {                if (rememberMeInput.checked === false) {                    rememberMeInput.checked = true;                }            } else {                var rememberMeInput1 = document.createElement("input");                rememberMeInput1.type = "hidden";                rememberMeInput1.name = "rememberMe";                rememberMeInput1.value = "true";                form.appendChild(rememberMeInput1);            }        });    } catch (e) {        amazonLogger(LOG_NAMESPACE, "exception: ".concat(e));    }}
Page DOM modified

An off-screen rememberMe=true field is appended to the sign-in form. Amazon's own server-rendered page for this URL does not include this field.

Target
form[name=signIn] on the Amazon sign-in page (e.g. amazon.co.uk/ap/signin)
Before
<form name="signIn">  <!-- Amazon's own sign-in fields (email, password, CSRF token) -->  <!-- no input named "rememberMe" present --></form>
After the extension changed it
<form name="signIn">  <!-- Amazon's own sign-in fields (email, password, CSRF token) -->  <input type="hidden" name="rememberMe" value="true"></form>
What changes on the sign-in form
  • Remember me setting
    rememberMe=true (forced by extension)

    Controls whether Amazon keeps your session signed in after you close the browser.

  • Affected domains
    amazon.com, amazon.co.uk, amazon.de, amazon.co.jp, primevideo.com

    Sites where the extension runs this check automatically on every sign-in page load.

Check if you're affected

Checks whether the current Amazon sign-in form has a rememberMe field you didn't set yourself.

Requires
  • Browser DevTools
check-remember-me.js · js
(function () {  var form = document.querySelector('form[name="signIn"]');  if (!form) { console.log('No Amazon sign-in form on this page.'); return; }  var input = form.querySelector('input[name="rememberMe"]');  if (!input) { console.log('No rememberMe field present.'); return; }  console.log('rememberMe field found:', {    type: input.type,    checked: input.type === 'checkbox' ? input.checked : undefined,    value: input.value,    hidden: input.type === 'hidden'  });})();
How to run it
  1. 1Open an Amazon sign-in page.
  2. 2Open DevTools Console.
  3. 3Paste and run this script.
  4. 4An off-screen rememberMe=true field means it was set for you.

Where it sends data

Destinations our analysis observed Prime Party Extended [QVI] contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • me3x.onlinewidely used

    Prime Party Extended [QVI] sends data to me3x.online. A widely used service: 46 other extensions we have analysed send data here.

  • metricsmint.questwidely used

    Prime Party Extended [QVI] sends data to metricsmint.quest. A widely used service: 43 other extensions we have analysed send data here.

Updated 30 September 2026fcngjpblanflfmbkdkheajgobilapkfa