Is SellerApp: Supercharge your Amazon Sales safe?

Medium risk

SellerApp Chrome Extension is medium risk. On install, the extension checks Amazon locales using your existing session. It also sends DELETE requests to Amazon's recent-searches API for the fixed term `samsung`; dynamic analysis observed 200 responses across several locales.

Strong link to a flagged operator: 1 of the 4 other listings from the same operator is rated high or critical for malicious behavior. Flagged: SellerApp Amazon Index Checker (high).

sellerapp-devv4.0.15Chrome Web Store
45Risk
Who publishes it

SellerApp - 4 other listings from the same operator, 4 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
sellerapp-dev
Declared legal entity
SellerApp
Registered address
800 West El Camino Real, suit 180,, Mountain View, CA, 94040, Mountain View, CA 94040, US
Registered contact
SellerApp

Same store account

4 other listings published from this account, 116k+ users between them. 4 of them carry a finding.

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.sellerapp.com
Also called by 2 other listings, including Amazon Keyword for Seller
cdn.sellerapp.com
Also called by 4 other listings, including Amazon Keyword for Seller
dashboard.sellerapp.com
Also called by 4 other listings, including Amazon Keyword for Seller

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Amazon searches deleted during locale checks

MediumunwantedCWE-200Dynamic sandbox

On install, the extension checks Amazon locales using your existing session.

What actually happens

You did this

You install the extension while the browser has an Amazon session available.

The extension did this

The extension checks Amazon locales and asks Amazon to remove the recent-search entry for samsung.

The deletion request is made after each locale check in the same automatic pass.

Captured request

DELETEhttps://completion.amazon.com/api/2017/recentsearches?mid=ATVPDKIKX0DER&s-value=samsung&s-search-alias=aps

200 OK. Dynamic analysis also observed successful DELETE requests to completion.amazon.ca, completion.amazon.com.mx, completion.amazon.co.uk, and completion.amazon.de with the same search value and alias.

Concrete fields in the recent-search deletion URL

  • Recent-search endpoint
    https://completion.amazon.com/api/2017/recentsearches

    This is the Amazon account feature being changed during the locale check.

  • Search value
    samsung

    This is the recent-search entry Amazon is asked to remove from the account history.

  • Marketplace ID
    ATVPDKIKX0DER

    This tells Amazon which country marketplace the account-history change applies to.

  • Search category
    aps

    This marks the deletion as applying to the general Amazon search category.

The code that does this

The locale loop calls the recent-search deletion helper

Readable version

Deobfuscated constants for the fixed search term and locale completion hosts

deobfuscated/background.js
const Tf=chrome.runtime.getManifest(),yf={US:"https://www.amazon.com",CA:"https://www.amazon.ca",MX:"https://www.amazon.com.mx",GB:"https://www.amazon.co.uk",DE:"https://www.amazon.de",FR:"https://www.amazon.fr",IT:"https://www.amazon.it",ES:"https://www.amazon.es",NL:"https://www.amazon.nl",SE:"https://www.amazon.se",PL:"https://www.amazon.pl",BE:"https://www.amazon.com.be",IE:"https://www.amazon.ie",TR:"https://www.amazon.com.tr",AE:"https://www.amazon.ae",SA:"https://www.amazon.sa",EG:"https://www.amazon.eg",IN:"https://www.amazon.in",SG:"https://www.amazon.sg",AU:"https://www.amazon.com.au",JP:"https://www.amazon.co.jp",BR:"https://www.amazon.com.br",ZA:"https://www.amazon.co.za"},gf="samsung",Ef={CA:{country:"Canada",marketplace_id:"A2EUQ1WTGCTBG2",domain:"amazon.ca"},US:{country:"United States of America",marketplace_id:"ATVPDKIKX0DER",domain:"amazon.com"},MX:{country:"Mexico",marketplace_id:"A1AM78C64UM0Y8",domain:"amazon.com.mx"},BR:{country:"Brazil",marketplace_id:"A2Q3Y263D00KWC",domain:"amazon.com.br"},ES:{country:"Spain",marketplace_id:"A1RKKUPIHCS9HS",domain:"amazon.es"},GB:{country:"United Kingdom",marketplace_id:"A1F83G8C2ARO7P",domain:"amazon.co.uk"},FR:{country:"France",marketplace_id:"A13V1IB3VIYZZH",domain:"amazon.fr"},IT:{country:"Italy",marketplace_id:"APJ6JRA9NG5V4",domain:"amazon.it"},DE:{country:"Germany",marketplace_id:"A1PA6795UKMFR9",domain:"amazon.de"},NL:{country:"Netherlands",marketplace_id:"A1805IZSGTT6HS",domain:"amazon.nl"},SE:{country:"Sweden",marketplace_id:"A2NODRKZP88ZB9",domain:"amazon.se"},PL:{country:"Poland",marketplace_id:"A1C3SOZRARQ6R3",domain:"amazon.pl"},BE:{country:"Belgium",marketplace_id:"AMEN7PMS3EDWL",domain:"amazon.com.be"},IN:{country:"India",marketplace_id:"A21TJRUUN4KGV",domain:"amazon.in"},AU:{country:"Australia",marketplace_id:"A39IBJ37TRP1C6",domain:"amazon.com.au"},JP:{country:"Japan",marketplace_id:"A1VC38T7YXB528",domain:"amazon.co.jp"},AE:{country:"United Arab Emirates",marketplace_id:"A2VIGQ35RCS4UG",domain:"amazon.ae"},SA:{country:"Saudi Arabia",marketplace_id:"A17E79C6D8DWNP",domain:"amazon.sa"},EG:{country:"Egypt",marketplace_id:"ARBP9OOSHTCHU",domain:"amazon.eg"},TR:{country:"Turkey",marketplace_id:"A33AVAJ2PDY3EV",domain:"amazon.com.tr"},SG:{country:"Singapore",marketplace_id:"A19VAU5U5O7RUS",domain:"amazon.sg"},ZA:{country:"South Africa",marketplace_id:"AE08WJ6YKNBMC",domain:"amazon.co.za"}}

Deobfuscated locale-check loop and DELETE helper

deobfuscated/background.js
Bf=()=>new Promise(((e,t)=>ff(void 0,void 0,void 0,(function*(){var t,n,r;const a=[];for(const e of Object.keys(yf)){const s=yield rf(`${yf[e]}/s?k=${gf}`),i=cf(s,Lp),o={geo:e};(null===(t=null==i?void 0:i.sign_in_button_url)||void 0===t?void 0:t.includes("signin"))?o.isLoggedIn=!1:o.isLoggedIn=!0;const c=cf(s,Mp);o.zipCode=c.zip_code,o.lang=c.lang;const u=cf(s,bp);if(null===(n=null==u?void 0:u.products)||void 0===n?void 0:n.length){const t=u.products.reduce(((e,t)=>(parseFloat(t.rating)||0)>(parseFloat(null==e?void 0:e.rating)||0)?t:e),u.products[0]);if(t.product_id)try{const n=yf[e],a=`${n}/product-reviews/${t.product_id}/ref=cm_cr_dp_d_show_all_btm?ie=UTF8`,s=yield rf(a),i=ym(s),c=i("#cr-state-object").attr("data-state"),u=i("[data-hook='request-success-message']").length>0;if(c&&u)o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (data-state + request already sent)`);else if(c)o.reviewsEnabled=!0,console.log(`[${e}] reviewsEnabled: true (data-state present)`);else if(u)o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (request already sent, pending)`);else if(o.isLoggedIn){const a=i("[data-reviews\\:ajax-post]").attr("data-reviews:ajax-post");if(a){const s=JSON.parse(a),i=null===(r=null==s?void 0:s.params)||void 0===r?void 0:r.csrfT;if(i){console.log(`[${e}] Requesting more reviews with csrfT:`,i);const r=`${n}${s.url}`,a=new URLSearchParams;a.append("csrfT",i),a.append("asin",t.product_id),a.append("scope","reviewsAjax0");const c=yield E().post(r,a.toString(),{headers:{"content-type":"application/x-www-form-urlencoded;charset=UTF-8",accept:"text/html,*/*","x-requested-with":"XMLHttpRequest"},adapter:T});console.log(`[${e}] Request more reviews response:`,c.data),o.reviewsEnabled=!0}}else o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (no ajax-post data found)`)}else o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (not logged in)`)}catch(t){o.reviewsEnabled=!1,console.log(`[${e}] Error checking reviews page:`,t)}}a.push(o);try{yield Wf(e)}catch(e){console.log("Error in deleting recent search")}}console.log("Multiple countries login result with top products:",a),e(a)})))),Wf=e=>{const t=Ef[e];return Yt.delete(`https://completion.${t.domain}/api/2017/recentsearches?mid=${t.marketplace_id}&s-value=${gf}&s-search-alias=aps`)}

Amazon hosts involved in the observed deletion traffic

    • completion.amazon.com

    Amazon completion API receiving the US recent-search deletion request.

    • completion.amazon.ca

    Amazon completion API receiving the Canada recent-search deletion request.

    • completion.amazon.com.mx

    Amazon completion API receiving the Mexico recent-search deletion request.

    • completion.amazon.co.uk

    Amazon completion API receiving the United Kingdom recent-search deletion request.

    • completion.amazon.de

    Amazon completion API receiving the Germany recent-search deletion request.

Updated 15 October 2026lofbbfcpljahnhgncgommcbkckdbjdof