Is キーゾンv3 safe?

Medium risk

キーゾンv3 is medium risk. On Amazon, Amazon Japan, and Keepa pages, the content script finds a product ID and Keepa API key, posts them to koubou3.com, and assigns the response fields sold and hist into page HTML sinks, so returned markup becomes part of the page.

sedori koubouv3.0.3Chrome Web Store
45Risk
Who publishes it

sedori koubou - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
sedori koubou
Registered address
Wakaba, 1-8-4-13, Shinjyuku, Tokyo 160-0011, Japan

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote HTML inserted into Amazon and Keepa pages

MediumunwantedCWE-829Dynamic sandbox

On Amazon, Amazon Japan, and Keepa pages, the content script finds a product ID and Keepa API key, posts them to koubou3.com, and assigns the response fields sold and hist into page HTML sinks, so returned markup becomes part of the page.

What actually happens

You did this

You open a supported Amazon or Keepa product page.

The content script is declared for Amazon, Amazon Japan, and Keepa and runs at document start.

The extension did this

The extension asks koubou3.com for product markup and inserts the returned HTML into the page.

The server response fields are assigned to variables and then written through .html(), .after(), and .append().

Captured request

POSThttps://koubou3.com/keezon/

The source expects a JSON response containing HTML-bearing sold and hist fields.

Fields handled by the request and response path

  • Product identifier
    asin=B08N5WRWNW (illustrative)

    This identifies which Amazon or Keepa product page you are viewing.

  • Marketplace selector
    k_country_i=5 for Japan, k_country_i=1 for US

    This tells the service whether the page belongs to Amazon Japan or Amazon US.

  • Saved Keepa API key
    key=abcd1234efgh5678 (illustrative)

    This sends the API key you saved in the extension options to the extension's service.

  • Filter setting
    filter=1 (illustrative)

    This carries the extension option that changes what product information is requested.

  • Returned sales panel HTML
    sold=<div class='keezon_sold'>sales panel markup</div> (illustrative)

    This markup is inserted into the current shopping page and controls what appears in the extension's product panel.

  • Returned history HTML
    hist=<div class='keezon_hist'>history panel markup</div> (illustrative)

    This markup is inserted on Keepa product pages as the extension's history section.

The code that does this

The remote response flows into HTML-writing sinks

Readable version

Readable data flow from response fields to page HTML

script.js
$.ajax({  type: 'POST',  url: 'https://koubou3.com/keezon/',  dataType: 'json',  data: {    asin: asin,    k_country_i: k_country_i,    key: e.apikey,    filter: e.filter  },  success: function(data) {    var salesPanelHtml = data.sold;    var historyPanelHtml = data.hist;    if (document.querySelector('#keezon_sold') != null) {      $('#keezon_sold').html(salesPanelHtml);    } else {      $(targetID).after(        "<div style='min-width: 935px; max-width: 1320px;' id='keezon_sold'>" +        salesPanelHtml +        "</div>"      );    }    if (mode1 !== -1) {      if (document.querySelector('#keezon_hist') != null) {        $('#keezon_hist').html(historyPanelHtml);      } else {        $('#casinLine').append(          "<div id='keezon_hist'>" + historyPanelHtml + "</div>"        );      }    }    var height = document.body.clientHeight;    window.parent.postMessage(height + 100, '*');  }});

The code that does this

The content script is loaded on the affected sites

Readable version

Readable manifest scope

manifest.json
content_scripts: [{  matches: [    'https://keepa.com/*',    'https://www.amazon.co.jp/*',    'https://www.amazon.com/*'  ],  js: ['jquery.min.js', 'script.js'],  run_at: 'document_start',  all_frames: true}]

External service in the verified path

    • koubou3.com

    Receives the product identifier, marketplace selector, saved Keepa API key, and filter option; returns the HTML strings later written into the page.

What it can do

Permissions this extension asks for, as declared in version 3.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 3.0.3, which we have not unpacked yet.

  • Read and change your data on qtas.sedo.li

    http://qtas.sedo.li/*

  • Read and change your data on app.sedo.li

    https://app.sedo.li/*

  • Read and change your data on keepa.com

    https://keepa.com/*

  • Read and change your data on koubou3.com

    https://koubou3.com/*

  • Read and change your data on www.amazon.co.jp

    https://www.amazon.co.jp/*

  • Read and change your data on www.amazon.com

    https://www.amazon.com/*

  • Store data in your browser

    storage

Updated 2 November 2026omnpnodbhognoblgbjmlagejkioccpih