Is SelectorsHub Pro safe?
SelectorsHub is medium risk. Opening the SelectorsHub Pro popup makes the extension fetch your public IP address and send it to Amplitude analytics as the user identifier. The confirmed request goes to api2.amplitude.com/2/httpapi with the IP as the tracked data.
Who publishes itSelectorsHub Tech Pvt Ltd - 15 other listings from the same operator, 3 of them carrying a finding
SelectorsHub Tech Pvt Ltd - 15 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 1k+ users between them, none of them carrying a finding.
Same operator - 14 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Popup sends your IP address to Amplitude as a user identifier.
Opening the SelectorsHub Pro popup makes the extension fetch your public IP address and send it to Amplitude analytics as the user identifier.
The confirmed request goes to api2.amplitude.com/2/httpapi with the IP as the tracked data.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open the extension popup from the toolbar.
The extension fetches your public IP address and uses it as the user identifier in an Amplitude analytics request.
- Your IP address203.0.113.42 (illustrative)
This can identify your network location and can be used as a persistent analytics user identifier.
Observed during dynamic analysis: opening the popup led to an IP lookup request followed by a POST to Amplitude with the returned IP address used as the user ID.