Is Spending Calculator for Amazon™ and Flipkart™ safe?

Medium risk

Spending Calculator for Amazon and Flipkart sends Amazon and Flipkart account contact details to sc.ecombullet.com.

When it detects you are logged in to Amazon or Flipkart, its content script reads profile fields such as phone number, email, and name, then posts phone and email values with the extension ID to ecombullet endpoints. It also redirects some Flipkart product clicks through goto.fpkrt.cc, reports selected browsing URLs to sc.ecombullet.com, and sends Amazon product IDs and prices to pricedata.bestbuydeals.in.

ecomspendingtrackerv2.5.1Chrome Web Store
51Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Amazon product pages you view auto-report price and ID to a third party

Opening any Amazon.in product page triggers an automatic request to pricedata.bestbuydeals.in with the product ID and current price.

No click or prompt is required; we captured the request firing on page load.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open an Amazon.in product page, any URL containing /dp/.

The extension did this

The content script reads the product ID and displayed price, then posts both to pricedata.bestbuydeals.in with no click or prompt.

Captured request
POSThttps://pricedata.bestbuydeals.in/product

We observed the extension render the response as price-history records back into the page's price-tracker panel.

Headers
Content-Type
application/json
Body
{  "productId": "B0D31QZDMP",  "currentPrice": 9900}
Fields sent to pricedata.bestbuydeals.in
  • Product ID (ASIN)
    B0D31QZDMP

    The specific Amazon product you are currently viewing.

  • Current price
    9900 (equivalent to Rs.99.00)

    The price shown on the page, in fractional currency units.

The code that does this

The Price component's automatic request on page load

Readable version
const initFn = () => {  let pgUrl = window.location.pathname  if (pgUrl.includes('/dp/')) {    let price = document.querySelector('#twister-plus-price-data-price')    const regex = /\/dp\/([A-Za-z0-9]+)/;    let productId = pgUrl.match(regex)[1]    setPrdtId(productId)    setPrdtprice(price.value)  }}const ReceivedMessage = (request) => {  if (request.message === 'PageUpdated') {    initFn()  }}useEffect(() => {  if (prdtId) {    setProductPgSelector(false)    fetchFn(prdtId)  }}, [prdtId])const fetchFn = (productId) => {  setLoading(true)  let url = 'https://pricedata.bestbuydeals.in/product'  fetch(url, {    method: "POST",    body: JSON.stringify({      "productId": productId,      "currentPrice": prdtprice ? prdtprice * 100 : null    }),    headers: { 'Content-Type': 'application/json' }  })    .then(response => response.json())    .then(res => { setProductPgSelector(true); /* ... */ })}
Third-party destinations
    • pricedata.bestbuydeals.in

    Receives the Amazon product ID and current price scraped from every Amazon product page you view.

Flipkart product clicks route through an affiliate redirect endpoint

When you click certain Flipkart product links, the extension can route the click via goto.fpkrt.cc before the product page loads.

The redirect carries the product URL and referrer, unrelated to the spending-calculator feature.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

The user clicks a Flipkart product link.

The extension did this

The extension intercepts eligible Flipkart clicks and redirects them through an affiliate endpoint with the original destination URL.

Captured request
GEThttps://goto.fpkrt.cc/product/
Fields in the redirect request
  • Your browsing URL
    https://www.flipkart.com/example-product/p/itm...?pid=ABC123 (illustrative)

    Shows the Flipkart product page the user intended to open.

  • Referrer context
    https://www.flipkart.com/search?q=shoes (illustrative)

    Can show the browsing context that led to the outgoing redirect.

What it can do

Permissions this extension asks for, as declared in version 2.5.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

  • Show you desktop notifications

    notifications

  • Receive push messages from its developer's servers

    gcm

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Spending Calculator for Amazon™ and Flipkart™ contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • goto.fpkrt.cc

    Spending Calculator for Amazon™ and Flipkart™ sends data to goto.fpkrt.cc. One other extension we have analysed sends data here.

  • pricedata.bestbuydeals.in

    Spending Calculator for Amazon™ and Flipkart™ sends data to pricedata.bestbuydeals.in. No other extension we have analysed sends data here.

  • sc.ecombullet.com

    Spending Calculator for Amazon™ and Flipkart™ sends data to sc.ecombullet.com. No other extension we have analysed sends data here.

Updated 30 September 2026pmkoilojjepdgnbhnbfmbpjbcgfgbaoe