Is SellerSprite - Amazon Research Tool safe?
SellerSprite is medium risk. The extension intercepts TikTok's internal API responses before the page processes them. Dynamic analysis captured three POSTs to plugin-data.kolsprite.com seconds after the feed loaded, with creator IDs, usernames, engagement stats.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
TikTok Feed Interception Sends Creator Data to kolsprite.com
The extension intercepts TikTok's internal API responses before the page processes them.
Dynamic analysis captured three POSTs to plugin-data.kolsprite.com seconds after the feed loaded, with creator IDs, usernames, engagement stats.
You navigate to tiktok.com or www.tiktok.com with the extension installed.
No further interaction is needed, interception begins as the page starts loading.
The extension sends TikTok creator profiles and video engagement data to plugin-data.kolsprite.com without a prompt.
Our dynamic analysis captured three POST requests to that endpoint during a single home-feed page load, each containing full video records with creator IDs, usernames, follower counts, and play statistics.
| Content-Type | application/json |
[
{
"author": {
"id": "7196800649023472683",
"uniqueId": "jul.spamz.fr",
"secUid": "MS4wLjABAAAA-GJj7FS6deTBTBKuRGiOI4f6Wr2Yk8WLzZm1QhYr3xA",
"followerCount": 42300,
"heartCount": 98700
},
"id": "7608248907960814879",
"stats": {
"playCount": 166300000,
"diggCount": 8920000,
"commentCount": 127400,
"shareCount": 91200
}
}
]| Field | Value | Why it matters | |
|---|---|---|---|
Creator numeric ID | 7196800649023472683 | TikTok's permanent internal ID for the video creator. It can link activity across sessions and platforms. | |
Creator username | jul.spamz.fr | The creator's public TikTok handle, directly identifying a real person's account. | |
Creator secUid | MS4wLjABAAAA-GJj7FS6deTBTBKuRGiOI4f... | A second immutable identifier for the TikTok account used by TikTok's internal APIs. | |
Follower count | 42300 | How many followers the creator had at the time this video appeared in your feed. | |
Total likes received | 98700 | The creator's aggregate heart count across all their videos, captured at browse time. | |
Video ID | 7608248907960814879 | Unique identifier for the specific video that appeared in your feed, revealing which content you viewed. | |
Video play count | 166300000 | Global view count for the video at the time of capture, included alongside the video ID. |
inject.ts.js, window.fetch override injected into TikTok's MAIN world
window.__kol_captureList = {
"/api/recommend/item_list/": "foryouVideoList",
"/api/post/item_list": "userVideoList",
"/api/repost/item_list": "userRepostList",
"/api/favorite/item_list": "userLikeList",
"/api/collection/item_list": "userFavoriteList",
"/api/user/collect/item_list/": "userPageFavoriteList",
"/api/search/general/full": "searchGeneralList",
"/api/search/item/full/": "searchVideoList",
"/api/explore/item_list/": "exploreVideoList",
"/api/challenge/item_list/": "tagVideoList",
"/api/following/item_list": "followingVideoList",
"/api/friends/item_list": "friendsVideoList",
"/api/music/item_list": "musicVideoList",
"/api/item/detail": "userVideoDetail",
"/api/shop": "shopList"
};
window.__kol_captureList_xhr = {
"/creator_studio/inspiration/trending/video": "inspirationTrendingList"
};
function y() {
let l = true;
const c = window.fetch;
window.fetch = async function (...t) {
let e = "", s;
const i = t[0], n = t[1];
if (typeof i == "string") {
e = i;
s = n?.credentials;
} else if (i instanceof URL) {
e = i.href;
s = n?.credentials;
} else if (i instanceof Request) {
e = i.url;
s = i.credentials;
}
if (s === "omit") return c.apply(this, t);
const d = Object.keys(window.__kol_captureList).find(r => e.includes(r));
if (!d) return c.apply(this, t);
const o = await c.apply(this, t),
m = o.clone(),
L = o.headers.get("Content-Type") || "";
if (!o.ok || !L.includes("application/json")) return o;
const w = await m.json();
return setTimeout(() => {
const r = new URLSearchParams(e);
if (r.get("post_item_list_request_type")) {
const p = r.get("post_item_list_request_type");
w.tkOrder = !p || p === "0" ? "Latest" : p === "1" ? "Popular" : "Oldest";
}
window.dispatchEvent(new CustomEvent(window.__kol_captureList[d], { detail: w }));
if (d === "/api/post/item_list")
window.dispatchEvent(new CustomEvent("urlRefererGet", { detail: e }));
l = false;
}, l ? 4000 : 1500), o;
};
// ... XHR interception follows the same pattern ...
}
window.__load_kol_ss = true;
setTimeout(() => {
window.__load_kol_main
? document.documentElement.dataset.__load_kol_main = "true"
: y();
}, 1);- plugin-data.kolsprite.com
Receives POST requests with TikTok video records (creator profiles, video IDs, engagement stats) harvested from intercepted API responses. Listed in the manifest host_permissions.
- www.kolsprite.com
Primary domain of the KolSprite influencer analytics service, which is the operator of the data collection. The extension's Amazon seller tools also connect to this host.
- o.kolsprite.com
Receives audio caption upload requests (POST multipart/form-data) from the background service worker when users invoke TikTok audio transcription features.