Is SellerSprite - Amazon Research Tool safe?

Medium risk

SellerSprite is medium risk. The extension intercepts TikTok's internal API responses before the page processes them. Dynamic analysis captured three POSTs to plugin-data.kolsprite.com seconds after the feed loaded, with creator IDs, usernames, engagement stats.

Yunya Technologyv5.0.5Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

TikTok Feed Interception Sends Creator Data to kolsprite.com

The extension intercepts TikTok's internal API responses before the page processes them.

Dynamic analysis captured three POSTs to plugin-data.kolsprite.com seconds after the feed loaded, with creator IDs, usernames, engagement stats.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to tiktok.com or www.tiktok.com with the extension installed.

No further interaction is needed, interception begins as the page starts loading.

The extension did this

The extension sends TikTok creator profiles and video engagement data to plugin-data.kolsprite.com without a prompt.

Our dynamic analysis captured three POST requests to that endpoint during a single home-feed page load, each containing full video records with creator IDs, usernames, follower counts, and play statistics.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://plugin-data.kolsprite.com/v1/plugin/video/label/add
Three requests of this form were captured automatically on TikTok home page load during dynamic analysis. The author.id, uniqueId, video.id, and stats.playCount values are from observed traffic; remaining numeric fields are representative of the captured payload structure (illustrative).
Headers
Content-Typeapplication/json
Body
[
  {
    "author": {
      "id": "7196800649023472683",
      "uniqueId": "jul.spamz.fr",
      "secUid": "MS4wLjABAAAA-GJj7FS6deTBTBKuRGiOI4f6Wr2Yk8WLzZm1QhYr3xA",
      "followerCount": 42300,
      "heartCount": 98700
    },
    "id": "7608248907960814879",
    "stats": {
      "playCount": 166300000,
      "diggCount": 8920000,
      "commentCount": 127400,
      "shareCount": 91200
    }
  }
]
03EvidenceFIELD TABLE
Creator and video fields observed in POST body
FieldValueWhy it matters
Creator numeric ID
7196800649023472683TikTok's permanent internal ID for the video creator. It can link activity across sessions and platforms.
Creator username
jul.spamz.frThe creator's public TikTok handle, directly identifying a real person's account.
Creator secUid
MS4wLjABAAAA-GJj7FS6deTBTBKuRGiOI4f...A second immutable identifier for the TikTok account used by TikTok's internal APIs.
Follower count
42300How many followers the creator had at the time this video appeared in your feed.
Total likes received
98700The creator's aggregate heart count across all their videos, captured at browse time.
Video ID
7608248907960814879Unique identifier for the specific video that appeared in your feed, revealing which content you viewed.
Video play count
166300000Global view count for the video at the time of capture, included alongside the video ID.
04EvidenceCODE COMPARE
The code that does this

inject.ts.js, window.fetch override injected into TikTok's MAIN world

What it actually does
window.__kol_captureList = {
  "/api/recommend/item_list/": "foryouVideoList",
  "/api/post/item_list": "userVideoList",
  "/api/repost/item_list": "userRepostList",
  "/api/favorite/item_list": "userLikeList",
  "/api/collection/item_list": "userFavoriteList",
  "/api/user/collect/item_list/": "userPageFavoriteList",
  "/api/search/general/full": "searchGeneralList",
  "/api/search/item/full/": "searchVideoList",
  "/api/explore/item_list/": "exploreVideoList",
  "/api/challenge/item_list/": "tagVideoList",
  "/api/following/item_list": "followingVideoList",
  "/api/friends/item_list": "friendsVideoList",
  "/api/music/item_list": "musicVideoList",
  "/api/item/detail": "userVideoDetail",
  "/api/shop": "shopList"
};
window.__kol_captureList_xhr = {
  "/creator_studio/inspiration/trending/video": "inspirationTrendingList"
};

function y() {
  let l = true;
  const c = window.fetch;
  window.fetch = async function (...t) {
    let e = "", s;
    const i = t[0], n = t[1];
    if (typeof i == "string") {
      e = i;
      s = n?.credentials;
    } else if (i instanceof URL) {
      e = i.href;
      s = n?.credentials;
    } else if (i instanceof Request) {
      e = i.url;
      s = i.credentials;
    }
    if (s === "omit") return c.apply(this, t);
    const d = Object.keys(window.__kol_captureList).find(r => e.includes(r));
    if (!d) return c.apply(this, t);
    const o = await c.apply(this, t),
      m = o.clone(),
      L = o.headers.get("Content-Type") || "";
    if (!o.ok || !L.includes("application/json")) return o;
    const w = await m.json();
    return setTimeout(() => {
      const r = new URLSearchParams(e);
      if (r.get("post_item_list_request_type")) {
        const p = r.get("post_item_list_request_type");
        w.tkOrder = !p || p === "0" ? "Latest" : p === "1" ? "Popular" : "Oldest";
      }
      window.dispatchEvent(new CustomEvent(window.__kol_captureList[d], { detail: w }));
      if (d === "/api/post/item_list")
        window.dispatchEvent(new CustomEvent("urlRefererGet", { detail: e }));
      l = false;
    }, l ? 4000 : 1500), o;
  };
  // ... XHR interception follows the same pattern ...
}
window.__load_kol_ss = true;
setTimeout(() => {
  window.__load_kol_main
    ? document.documentElement.dataset.__load_kol_main = "true"
    : y();
}, 1);
05EvidenceTHIRD PARTY LIST
Destinations receiving TikTok data
  • plugin-data.kolsprite.com

    Receives POST requests with TikTok video records (creator profiles, video IDs, engagement stats) harvested from intercepted API responses. Listed in the manifest host_permissions.

  • www.kolsprite.com

    Primary domain of the KolSprite influencer analytics service, which is the operator of the data collection. The extension's Amazon seller tools also connect to this host.

  • o.kolsprite.com

    Receives audio caption upload requests (POST multipart/form-data) from the background service worker when users invoke TikTok audio transcription features.

Updated 10 September 2026lnbmbgocenenhhhdojdielgnmeflbnfb