Is SellerApp: Supercharge your Amazon Sales safe?

Medium risk

SellerApp Chrome Extension is medium risk. On install, the extension checks Amazon locales using your existing session. It also sends DELETE requests to Amazon's recent-searches API for the fixed term `samsung`; dynamic analysis observed 200 responses across several locales.

sellerapp-devv4.0.13Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Amazon searches deleted during locale checks

On install, the extension checks Amazon locales using your existing session.

It also sends DELETE requests to Amazon's recent-searches API for the fixed term `samsung`; dynamic analysis observed 200 responses across several locales.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension while the browser has an Amazon session available.

The extension did this

The extension checks Amazon locales and asks Amazon to remove the recent-search entry for `samsung`.

The deletion request is made after each locale check in the same automatic pass.

02EvidenceNETWORK CAPTURE
Captured request
DELETEhttps://completion.amazon.com/api/2017/recentsearches?mid=ATVPDKIKX0DER&s-value=samsung&s-search-alias=aps
200 OK. Dynamic analysis also observed successful DELETE requests to completion.amazon.ca, completion.amazon.com.mx, completion.amazon.co.uk, and completion.amazon.de with the same search value and alias.
03EvidenceFIELD TABLE
Concrete fields in the recent-search deletion URL
FieldValueWhy it matters
Recent-search endpoint
https://completion.amazon.com/api/2017/recentsearchesThis is the Amazon account feature being changed during the locale check.
Search value
samsungThis is the recent-search entry Amazon is asked to remove from the account history.
Marketplace ID
ATVPDKIKX0DERThis tells Amazon which country marketplace the account-history change applies to.
Search category
apsThis marks the deletion as applying to the general Amazon search category.
04EvidenceCODE COMPARE
The code that does this

The locale loop calls the recent-search deletion helper

What it actually does
Deobfuscated constants for the fixed search term and locale completion hostsdeobfuscated/background.js
const Tf=chrome.runtime.getManifest(),yf={US:"https://www.amazon.com",CA:"https://www.amazon.ca",MX:"https://www.amazon.com.mx",GB:"https://www.amazon.co.uk",DE:"https://www.amazon.de",FR:"https://www.amazon.fr",IT:"https://www.amazon.it",ES:"https://www.amazon.es",NL:"https://www.amazon.nl",SE:"https://www.amazon.se",PL:"https://www.amazon.pl",BE:"https://www.amazon.com.be",IE:"https://www.amazon.ie",TR:"https://www.amazon.com.tr",AE:"https://www.amazon.ae",SA:"https://www.amazon.sa",EG:"https://www.amazon.eg",IN:"https://www.amazon.in",SG:"https://www.amazon.sg",AU:"https://www.amazon.com.au",JP:"https://www.amazon.co.jp",BR:"https://www.amazon.com.br",ZA:"https://www.amazon.co.za"},gf="samsung",Ef={CA:{country:"Canada",marketplace_id:"A2EUQ1WTGCTBG2",domain:"amazon.ca"},US:{country:"United States of America",marketplace_id:"ATVPDKIKX0DER",domain:"amazon.com"},MX:{country:"Mexico",marketplace_id:"A1AM78C64UM0Y8",domain:"amazon.com.mx"},BR:{country:"Brazil",marketplace_id:"A2Q3Y263D00KWC",domain:"amazon.com.br"},ES:{country:"Spain",marketplace_id:"A1RKKUPIHCS9HS",domain:"amazon.es"},GB:{country:"United Kingdom",marketplace_id:"A1F83G8C2ARO7P",domain:"amazon.co.uk"},FR:{country:"France",marketplace_id:"A13V1IB3VIYZZH",domain:"amazon.fr"},IT:{country:"Italy",marketplace_id:"APJ6JRA9NG5V4",domain:"amazon.it"},DE:{country:"Germany",marketplace_id:"A1PA6795UKMFR9",domain:"amazon.de"},NL:{country:"Netherlands",marketplace_id:"A1805IZSGTT6HS",domain:"amazon.nl"},SE:{country:"Sweden",marketplace_id:"A2NODRKZP88ZB9",domain:"amazon.se"},PL:{country:"Poland",marketplace_id:"A1C3SOZRARQ6R3",domain:"amazon.pl"},BE:{country:"Belgium",marketplace_id:"AMEN7PMS3EDWL",domain:"amazon.com.be"},IN:{country:"India",marketplace_id:"A21TJRUUN4KGV",domain:"amazon.in"},AU:{country:"Australia",marketplace_id:"A39IBJ37TRP1C6",domain:"amazon.com.au"},JP:{country:"Japan",marketplace_id:"A1VC38T7YXB528",domain:"amazon.co.jp"},AE:{country:"United Arab Emirates",marketplace_id:"A2VIGQ35RCS4UG",domain:"amazon.ae"},SA:{country:"Saudi Arabia",marketplace_id:"A17E79C6D8DWNP",domain:"amazon.sa"},EG:{country:"Egypt",marketplace_id:"ARBP9OOSHTCHU",domain:"amazon.eg"},TR:{country:"Turkey",marketplace_id:"A33AVAJ2PDY3EV",domain:"amazon.com.tr"},SG:{country:"Singapore",marketplace_id:"A19VAU5U5O7RUS",domain:"amazon.sg"},ZA:{country:"South Africa",marketplace_id:"AE08WJ6YKNBMC",domain:"amazon.co.za"}}
Deobfuscated locale-check loop and DELETE helperdeobfuscated/background.js
Bf=()=>new Promise(((e,t)=>ff(void 0,void 0,void 0,(function*(){var t,n,r;const a=[];for(const e of Object.keys(yf)){const s=yield rf(`${yf[e]}/s?k=${gf}`),i=cf(s,Lp),o={geo:e};(null===(t=null==i?void 0:i.sign_in_button_url)||void 0===t?void 0:t.includes("signin"))?o.isLoggedIn=!1:o.isLoggedIn=!0;const c=cf(s,Mp);o.zipCode=c.zip_code,o.lang=c.lang;const u=cf(s,bp);if(null===(n=null==u?void 0:u.products)||void 0===n?void 0:n.length){const t=u.products.reduce(((e,t)=>(parseFloat(t.rating)||0)>(parseFloat(null==e?void 0:e.rating)||0)?t:e),u.products[0]);if(t.product_id)try{const n=yf[e],a=`${n}/product-reviews/${t.product_id}/ref=cm_cr_dp_d_show_all_btm?ie=UTF8`,s=yield rf(a),i=ym(s),c=i("#cr-state-object").attr("data-state"),u=i("[data-hook='request-success-message']").length>0;if(c&&u)o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (data-state + request already sent)`);else if(c)o.reviewsEnabled=!0,console.log(`[${e}] reviewsEnabled: true (data-state present)`);else if(u)o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (request already sent, pending)`);else if(o.isLoggedIn){const a=i("[data-reviews\\:ajax-post]").attr("data-reviews:ajax-post");if(a){const s=JSON.parse(a),i=null===(r=null==s?void 0:s.params)||void 0===r?void 0:r.csrfT;if(i){console.log(`[${e}] Requesting more reviews with csrfT:`,i);const r=`${n}${s.url}`,a=new URLSearchParams;a.append("csrfT",i),a.append("asin",t.product_id),a.append("scope","reviewsAjax0");const c=yield E().post(r,a.toString(),{headers:{"content-type":"application/x-www-form-urlencoded;charset=UTF-8",accept:"text/html,*/*","x-requested-with":"XMLHttpRequest"},adapter:T});console.log(`[${e}] Request more reviews response:`,c.data),o.reviewsEnabled=!0}}else o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (no ajax-post data found)`)}else o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (not logged in)`)}catch(t){o.reviewsEnabled=!1,console.log(`[${e}] Error checking reviews page:`,t)}}a.push(o);try{yield Wf(e)}catch(e){console.log("Error in deleting recent search")}}console.log("Multiple countries login result with top products:",a),e(a)})))),Wf=e=>{const t=Ef[e];return Yt.delete(`https://completion.${t.domain}/api/2017/recentsearches?mid=${t.marketplace_id}&s-value=${gf}&s-search-alias=aps`)}
05EvidenceTHIRD PARTY LIST
Amazon hosts involved in the observed deletion traffic
  • completion.amazon.com

    Amazon completion API receiving the US recent-search deletion request.

  • completion.amazon.ca

    Amazon completion API receiving the Canada recent-search deletion request.

  • completion.amazon.com.mx

    Amazon completion API receiving the Mexico recent-search deletion request.

  • completion.amazon.co.uk

    Amazon completion API receiving the United Kingdom recent-search deletion request.

  • completion.amazon.de

    Amazon completion API receiving the Germany recent-search deletion request.

Updated 17 September 2026lofbbfcpljahnhgncgommcbkckdbjdof