Is Spending Calculator For Zepto & Blinkit safe?
Spending Calculator For Zepto & Blinkit is high risk. Clicking the Zepto analyzer, the extension reads your Zepto profile from storage, uses Zepto cookies to fetch order pages/details, builds a combined profile/purchase-history object, and posts it to qc.fooddy.in/api/zepto/insert.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Zepto profile and order history posted to Fooddy
Clicking the Zepto analyzer, the extension reads your Zepto profile from storage, uses Zepto cookies to fetch order pages/details, builds a combined profile/purchase-history object, and posts it to qc.fooddy.in/api/zepto/insert.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You click the extension's analyzer while signed in to Zepto.
The popup sends the active Zepto tab a start message.
The extension collects your Zepto profile, address, and order details and posts them to Fooddy.
The POST target is https://qc.fooddy.in/api/zepto/insert.
The shipped code parses the response as JSON.
- Content-Type
- application/json
- Your Zepto profileAarav Sharma, +91 98765 43210, aarav@example.com, Indiranagar, Bengaluru (illustrative)
Your name, phone number, email address, and delivery address identify the Zepto account and where orders are delivered.
- Your order historyorder 7f4d8b2c, placed 2026-07-10T19:42:00+05:30, paid 1247.50, DELIVERED (illustrative)
Order IDs, order times, totals, discounts, status, and drop addresses describe what you bought and where it was delivered.
- Products inside each orderBasmati Rice 5 kg, brand Daawat, quantity 1, item price 699.00 (illustrative)
Product names, brands, quantities, unit prices, and item totals reveal detailed purchase preferences.
- Zepto session cookies used locallyaccessToken, device_id, session_id, XSRF-TOKEN
The extension uses Zepto cookies to request the order list and order-detail responses from Zepto while you are signed in.
Shipped code that starts collection, builds the object, and posts it
Readable source-map version of the popup trigger
static/js/main.b462c575.js.map#AnalyzePage.jsconst handleAnalyzer = () => { setFlag(false); if (!analyzing) { setAnalyzing(true); setAmt("_ _ _ _ _ _"); chrome.tabs.query({ active: true, currentWindow: true }, function (tabs) { chrome.tabs.sendMessage(tabs[0].id, { msg: "start" }); }); } };Readable shipped content-script flow
content/content.jschrome.runtime.onMessage.addListener(function (request, sender, sendResponse) { if (request.msg === "start") { if (hostnm.includes("zeptonow")) { zeptoObj = {}; zeptoDataDetailsArr = []; zeptoTotAmt = 0; flag = true; productListArr = []; productQuantities = {}; zeptoFetch(1); } else if (hostnm.includes("blinkit")) { blinkitTotAmt = 0; productListArr = []; productQuantities = {}; blinkitDetailedData(); // blinkitMostOrdered(); } }});Service worker requests Zepto order data using cookies from the page
Same readable shipped source
background/background.jschrome.runtime.onMessage.addListener((msg, sender, sendResponse) => { if (msg.action === 'fetchZeptoOrders') { // existing list fetch handler const { accessToken, deviceId, sessionId, xsrfToken, page } = msg; const reqId = crypto.randomUUID(); const signature = msg.signature || generateSignature( `/api/v2/order/?page_number=${page}`, xsrfToken ); fetch(`https://api.zeptonow.com/api/v2/order/?page_number=${page}`, { method: 'GET', credentials: 'include', headers: { "Accept": "application/json, text/plain, /*", "Accept-Encoding": "gzip, deflate, br", "Accept-Language": "en-US,en;q=0.9", "Appversion": "12.71.1", "Origin": "https://www.zeptonow.com", "Referer": "https://www.zeptonow.com/", "request-signature": signature, "request_id": reqId, "requestid": reqId, "x-xsrf-token": xsrfToken, "x-timezone": new Date().getTimezoneOffset().toString() } }) .then(r => r.json()) .then(data => sendResponse(data)) .catch(err => sendResponse({ error: err.message })); return true; } else if (msg.action === 'fetchZeptoOrderDetail') { // new detail fetch handler const { accessToken, orderId, xsrfToken } = msg; const reqId = crypto.randomUUID(); const signature = msg.signature || generateSignature( `/api/v1/order/${orderId}/`, xsrfToken ); fetch(`https://api.zeptonow.com/api/v1/order/${orderId}/`, { method: 'GET', credentials: 'include', headers: { "Accept": "application/json, text/plain, /*", "Accept-Encoding": "gzip, deflate, br", "Accept-Language": "en-US,en;q=0.9", "Appversion": "12.71.1", "Origin": "https://www.zeptonow.com", "Referer": "https://www.zeptonow.com/", "request-signature": signature, "request_id": reqId, "requestid": reqId, "x-xsrf-token": xsrfToken, "x-timezone": new Date().getTimezoneOffset().toString() } }) .then(r => r.json()) .then(data => sendResponse(data)) .catch(err => sendResponse({ error: err.message })); return true; }});- qc.fooddy.in
Receives the assembled Zepto userDetails and dataDetails object from the extension's POST request.
- api.zeptonow.com
Returns Zepto order lists and per-order details that the extension uses to build the posted purchase-history object.
- cdn.zeptonow.com
Product image URLs are constructed from Zepto product data and included in each product record.
What it can do
Permissions this extension asks for, as declared in version 1.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Show you desktop notifications
notifications