Is SellerApp: Supercharge your Amazon Sales safe?
SellerApp Chrome Extension is medium risk. On install, the extension checks Amazon locales using your existing session. It also sends DELETE requests to Amazon's recent-searches API for the fixed term `samsung`; dynamic analysis observed 200 responses across several locales.
Strong link to a flagged operator: 1 of the 4 other listings from the same operator is rated high or critical for malicious behavior. Flagged: SellerApp Amazon Index Checker (high).
Who publishes itSellerApp - 4 other listings from the same operator, 4 of them carrying a finding
SellerApp - 4 other listings from the same operator, 4 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
4 other listings published from this account, 116k+ users between them. 4 of them carry a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Amazon searches deleted during locale checks
On install, the extension checks Amazon locales using your existing session.
It also sends DELETE requests to Amazon's recent-searches API for the fixed term samsung; dynamic analysis observed 200 responses across several locales.
What actually happens
You install the extension while the browser has an Amazon session available.
The extension checks Amazon locales and asks Amazon to remove the recent-search entry for samsung.
The deletion request is made after each locale check in the same automatic pass.
Captured request
200 OK. Dynamic analysis also observed successful DELETE requests to completion.amazon.ca, completion.amazon.com.mx, completion.amazon.co.uk, and completion.amazon.de with the same search value and alias.
Concrete fields in the recent-search deletion URL
- Recent-search endpointhttps://completion.amazon.com/api/2017/recentsearches
This is the Amazon account feature being changed during the locale check.
- Search valuesamsung
This is the recent-search entry Amazon is asked to remove from the account history.
- Marketplace IDATVPDKIKX0DER
This tells Amazon which country marketplace the account-history change applies to.
- Search categoryaps
This marks the deletion as applying to the general Amazon search category.
The code that does this
The locale loop calls the recent-search deletion helper
Deobfuscated constants for the fixed search term and locale completion hosts
deobfuscated/background.jsconst Tf=chrome.runtime.getManifest(),yf={US:"https://www.amazon.com",CA:"https://www.amazon.ca",MX:"https://www.amazon.com.mx",GB:"https://www.amazon.co.uk",DE:"https://www.amazon.de",FR:"https://www.amazon.fr",IT:"https://www.amazon.it",ES:"https://www.amazon.es",NL:"https://www.amazon.nl",SE:"https://www.amazon.se",PL:"https://www.amazon.pl",BE:"https://www.amazon.com.be",IE:"https://www.amazon.ie",TR:"https://www.amazon.com.tr",AE:"https://www.amazon.ae",SA:"https://www.amazon.sa",EG:"https://www.amazon.eg",IN:"https://www.amazon.in",SG:"https://www.amazon.sg",AU:"https://www.amazon.com.au",JP:"https://www.amazon.co.jp",BR:"https://www.amazon.com.br",ZA:"https://www.amazon.co.za"},gf="samsung",Ef={CA:{country:"Canada",marketplace_id:"A2EUQ1WTGCTBG2",domain:"amazon.ca"},US:{country:"United States of America",marketplace_id:"ATVPDKIKX0DER",domain:"amazon.com"},MX:{country:"Mexico",marketplace_id:"A1AM78C64UM0Y8",domain:"amazon.com.mx"},BR:{country:"Brazil",marketplace_id:"A2Q3Y263D00KWC",domain:"amazon.com.br"},ES:{country:"Spain",marketplace_id:"A1RKKUPIHCS9HS",domain:"amazon.es"},GB:{country:"United Kingdom",marketplace_id:"A1F83G8C2ARO7P",domain:"amazon.co.uk"},FR:{country:"France",marketplace_id:"A13V1IB3VIYZZH",domain:"amazon.fr"},IT:{country:"Italy",marketplace_id:"APJ6JRA9NG5V4",domain:"amazon.it"},DE:{country:"Germany",marketplace_id:"A1PA6795UKMFR9",domain:"amazon.de"},NL:{country:"Netherlands",marketplace_id:"A1805IZSGTT6HS",domain:"amazon.nl"},SE:{country:"Sweden",marketplace_id:"A2NODRKZP88ZB9",domain:"amazon.se"},PL:{country:"Poland",marketplace_id:"A1C3SOZRARQ6R3",domain:"amazon.pl"},BE:{country:"Belgium",marketplace_id:"AMEN7PMS3EDWL",domain:"amazon.com.be"},IN:{country:"India",marketplace_id:"A21TJRUUN4KGV",domain:"amazon.in"},AU:{country:"Australia",marketplace_id:"A39IBJ37TRP1C6",domain:"amazon.com.au"},JP:{country:"Japan",marketplace_id:"A1VC38T7YXB528",domain:"amazon.co.jp"},AE:{country:"United Arab Emirates",marketplace_id:"A2VIGQ35RCS4UG",domain:"amazon.ae"},SA:{country:"Saudi Arabia",marketplace_id:"A17E79C6D8DWNP",domain:"amazon.sa"},EG:{country:"Egypt",marketplace_id:"ARBP9OOSHTCHU",domain:"amazon.eg"},TR:{country:"Turkey",marketplace_id:"A33AVAJ2PDY3EV",domain:"amazon.com.tr"},SG:{country:"Singapore",marketplace_id:"A19VAU5U5O7RUS",domain:"amazon.sg"},ZA:{country:"South Africa",marketplace_id:"AE08WJ6YKNBMC",domain:"amazon.co.za"}}Deobfuscated locale-check loop and DELETE helper
deobfuscated/background.jsBf=()=>new Promise(((e,t)=>ff(void 0,void 0,void 0,(function*(){var t,n,r;const a=[];for(const e of Object.keys(yf)){const s=yield rf(`${yf[e]}/s?k=${gf}`),i=cf(s,Lp),o={geo:e};(null===(t=null==i?void 0:i.sign_in_button_url)||void 0===t?void 0:t.includes("signin"))?o.isLoggedIn=!1:o.isLoggedIn=!0;const c=cf(s,Mp);o.zipCode=c.zip_code,o.lang=c.lang;const u=cf(s,bp);if(null===(n=null==u?void 0:u.products)||void 0===n?void 0:n.length){const t=u.products.reduce(((e,t)=>(parseFloat(t.rating)||0)>(parseFloat(null==e?void 0:e.rating)||0)?t:e),u.products[0]);if(t.product_id)try{const n=yf[e],a=`${n}/product-reviews/${t.product_id}/ref=cm_cr_dp_d_show_all_btm?ie=UTF8`,s=yield rf(a),i=ym(s),c=i("#cr-state-object").attr("data-state"),u=i("[data-hook='request-success-message']").length>0;if(c&&u)o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (data-state + request already sent)`);else if(c)o.reviewsEnabled=!0,console.log(`[${e}] reviewsEnabled: true (data-state present)`);else if(u)o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (request already sent, pending)`);else if(o.isLoggedIn){const a=i("[data-reviews\\:ajax-post]").attr("data-reviews:ajax-post");if(a){const s=JSON.parse(a),i=null===(r=null==s?void 0:s.params)||void 0===r?void 0:r.csrfT;if(i){console.log(`[${e}] Requesting more reviews with csrfT:`,i);const r=`${n}${s.url}`,a=new URLSearchParams;a.append("csrfT",i),a.append("asin",t.product_id),a.append("scope","reviewsAjax0");const c=yield E().post(r,a.toString(),{headers:{"content-type":"application/x-www-form-urlencoded;charset=UTF-8",accept:"text/html,*/*","x-requested-with":"XMLHttpRequest"},adapter:T});console.log(`[${e}] Request more reviews response:`,c.data),o.reviewsEnabled=!0}}else o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (no ajax-post data found)`)}else o.reviewsEnabled=!1,console.log(`[${e}] reviewsEnabled: false (not logged in)`)}catch(t){o.reviewsEnabled=!1,console.log(`[${e}] Error checking reviews page:`,t)}}a.push(o);try{yield Wf(e)}catch(e){console.log("Error in deleting recent search")}}console.log("Multiple countries login result with top products:",a),e(a)})))),Wf=e=>{const t=Ef[e];return Yt.delete(`https://completion.${t.domain}/api/2017/recentsearches?mid=${t.marketplace_id}&s-value=${gf}&s-search-alias=aps`)}Amazon hosts involved in the observed deletion traffic
- completion.amazon.com
Amazon completion API receiving the US recent-search deletion request.
- completion.amazon.ca
Amazon completion API receiving the Canada recent-search deletion request.
- completion.amazon.com.mx
Amazon completion API receiving the Mexico recent-search deletion request.
- completion.amazon.co.uk
Amazon completion API receiving the United Kingdom recent-search deletion request.
- completion.amazon.de
Amazon completion API receiving the Germany recent-search deletion request.