Is Sell The Trend - Winning Product Dropshipping safe?

Medium risk

Sell The Trend sends detected Shopify store hostnames and Facebook ad metadata to SellTheTrend services.

On ordinary webpages, the extension probes for Shopify product data and sends detected store hostnames with the SellTheTrend user ID to SellTheTrend APIs. On Facebook pages, it captures sponsored ad response metadata, builds ad and post details, adds the SellTheTrend login ID and public IP address, and posts the result to SellTheTrend's ad service.

sellthetrend.comv3.2.2Chrome Web Store
45Risk
Who publishes it

Sell The Trend Crop - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
sellthetrend.com
Declared legal entity
Sell The Trend Crop
Registered address
5694 Hwy 7, Woodbridge, ON L4L1B0, CA
Registered contact
Sell The Trend Crop

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Sell The Trend checks every site you visit for Shopify and reports it

On every site you visit besides AliExpress, CJDropshipping, or Facebook, Sell The Trend's content script checks for a Shopify store and, without a click, sends the site's hostname to sellthetrend.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You visit any website other than AliExpress, CJDropshipping, or Facebook with the extension installed.

No click on the extension's icon or popup is needed.

The extension did this

The extension checks whether the site is a Shopify store, then sends the site's hostname to sellthetrend.com.

This runs on ordinary websites, not just the ecommerce sites named in the extension's own host permissions.

What SellTheTrend receives about the site you're on
  • Website hostname
    www.allbirds.com

    Shows SellTheTrend which store you visited, even without you searching for it or opening the extension.

  • Your account ID
    uid_58204 (illustrative)

    When you're logged in to SellTheTrend, ties the visited store to your specific account.

Captured request
POSThttps://www.sellthetrend.com/api/store-intelligence/show
Headers
Content-Type
application/json
Body
{  "search": "www.allbirds.com"}
The code that does this

The automatic Shopify probe and hostname report

Readable version

Detects a Shopify storefront

// Detects whether the current page's own origin serves a Shopify-style// product feed. This runs on the page the user is visiting, not on// aliexpress.com/cjdropshipping.com/facebook.com.async function looksLikeShopifyStore() {  try {    const res = await fetch(`${window.location.origin}/products.json`);    if (res.ok) {      const data = await res.json();      return Array.isArray(data.products);    }  } catch {}  return false;}

Decides when to run the probe

// Runs once per page load (document_idle, <all_urls>, all frames).function detectPageType() {  const [pageTypes, setPageTypes] = useState([]);  useEffect(() => {    (async () => {      const url = new URL(window.location.href);      const types = [];      if (/aliexpress\.(com|us)/.test(url.hostname)) {        types.push("AliExpress" /* + sub-type */);      } else if (url.hostname.includes("cjdropshipping.com")) {        types.push("CJD" /* + sub-type */);      } else if (url.hostname.includes("facebook.com")) {        types.push("Facebook" /* + sub-type */);      } else if (await looksLikeShopifyStore()) {        // Every other site on the web lands here.        types.push("Shopify");      }      setPageTypes(types);    })();  }, []);  return pageTypes;}

Reports the hostname to SellTheTrend

// Called with window.location.hostname as soon as a page is classified// as "Shopify" (see detectPageType above).function useStoreIntelligence({ userAuthData, loading }) {  return {    setStoreIntelligence: async (hostname) => {      if (loading) return;      const { uid } = userAuthData; // undefined if not logged in to SellTheTrend      const payload = { uid, search: hostname };      // POSTed with no user click on the extension, immediately after      // the /products.json probe resolves.      await api.post(        "https://www.sellthetrend.com/api/store-intelligence/show",        payload,        { headers: { Authorization: "Bearer <app token>" } }      );    },  };}
Where the data ends up
    • www.sellthetrend.com

    SellTheTrend's own backend. Receives the hostname of every Shopify-shaped site you visit, plus your account ID when you're logged in.

Where it sends data

Destinations our analysis observed Sell The Trend - Winning Product Dropshipping contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.ipify.orgwidely used

    Sell The Trend - Winning Product Dropshipping sends data to api.ipify.org. A widely used service: 41 other extensions we have analysed send data here.

  • adsservice.sellthetrend.com

    Sell The Trend - Winning Product Dropshipping sends data to adsservice.sellthetrend.com. No other extension we have analysed sends data here.

  • www.sellthetrend.com

    Sell The Trend - Winning Product Dropshipping sends data to www.sellthetrend.com. No other extension we have analysed sends data here.

Updated 30 September 2026fhogkjponmmfhiffnefhpehmaignblce