Chrome Web Store
1Versions
1Code reviewed

Do not install

Code review: critical

Our reviewer read this extension’s code and confirmed malicious behaviour. 4 security findings documented below. Do not install it. Remove it if you already have it.

2 critical findings in this extension’s code

2 critical
2 high
6 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

What our analysis found

Amazon Product Scraper | 10X is rated malicious by Extension Auditor. Our code review reported 4 findings (2 critical, 2 high), led by tracking. Its permissions mean it can inject scripts into pages.

Key findings

  • Critical

    Tracking

    On every extension-enable event the background script queries all open browser tabs with no URL filter and silently rewrites `exft=false` to `exft=true` in any matching URL. `exft` is the affiliate-attribution token used by the [domain withheld] redirect infrastructure; changing this flag without user knowledge reroutes purchase commissions to the extension operator. An Amazon product scraper has no legitimate reason to scan all open tabs and mutate their URLs on extension enable.

  • Critical

    Tracking

    The same covert affiliate-tag rewrite (`exft=false` → `exft=true`) is also performed immediately on fresh installation via the `onInstalled` (INSTALL reason) handler. Together with the `management.onEnabled` handler, this guarantees the manipulation runs on first install and on every subsequent re-enable, maximising the number of browser sessions tagged with the operator's affiliate identifier.

  • High

    Other

    The extension auto-injects content scripts onto `searchcrwler-a/[domain withheld]` — a third-party domain unrelated to Amazon product scraping and not the publisher's own site ([domain withheld]). These 'search crawler' subdomains are the affiliate-redirect infrastructure identified in the [domain withheld] IoC report. Granting both host_permissions and content_script access to this domain enables the extension to read and manipulate pages served by the hijacking backend, a capability with no disclosed or legitimate purpose in an Amazon scraper.

  • High

    Other

    The extension accepts external messages from other extensions or web pages using the undocumented key `"10xprofitRefTabId"`, stores the caller's tab ID, and then reloads that tab on the next `onInstalled` event. This cross-extension coordination channel allows the [domain withheld] operator to remotely identify and reload arbitrary browser tabs, supporting the affiliate-hijacking workflow by ensuring the rewritten URL (with `exft=true`) is fully applied.

Analyst notes

The extension performs covert tab-wide URL parameter manipulation on install and re-enable: registers both a `chrome.management.onEnabled` listener and an `onInstalled` (INSTALL) listener that each query **all** open browser tabs and silently rewrite any URL containing `exft=false` to `exft=true` via `chrome.tabs.update()`. This parameter is the affiliate attribution token used by the [domain withheld] redirect infrastructure — the extension injects content scripts onto `searchcrwler-a/[domain withheld]` in the manifest, confirming it is part of the affiliate-hijacking chain documented at the IoC source ([domain withheld] blog, added 2026-02-02). Publisher has a 100% malicious track record ( other extensions flagged), the permhash cluster is 100% malicious (only this version), and the scores and IoC all corroborate; no signals contradict the malicious verdict.

Amazon Product Scraper | 10X

Amazon Product Scraper | 10X Chrome extension security report

ID: mnacfoefejolpobogooghoclppjcgfcm

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Active
Version
3.0.1
Size
0.24 MB
Rating
5.0/5
Reviews
1
Users
34
Type
Extension
Updated
Dec 10, 2025
Category
Tools
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
This publisherTrack record
20extensions
All still listed

Publisher Contextual Analysis

Author
10Xprofit
Country
BD
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Address
House: 1034, Avenue: 8, Mirpur DOHS Dhaka 1216 BD
Website
Visit
Extensions
20
Active
20
Obsolete
0
Listed
20
Unlisted
0
Users
1,220

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5

Install growth

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
Contextual Risk Factors
Risk Factor
High
The following context increases the overall risk:• 20% increase: Access to sensitive domains increases potential impact
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
http://localhost:3000/*
Host
Medium
Host permission — access limited to this URL pattern.
https://www.amazon.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://completion.amazon.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://searchcrwler-b.ecomstal.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://searchcrwler-a.ecomstal.com/*
Host
Medium
Host permission — access limited to this URL pattern.
https://app.10xprofit.io/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.com/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.com.mx/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.com.au/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.co.uk/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.ca/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.de/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.fr/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.in/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.nl/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.it/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.co.jp/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.at/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.es/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.cn/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.ae/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.com.br/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.eg/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.sa/*
Host
Medium
Host permission — access limited to this URL pattern.
*://*.amazon.pl/*
Host
Medium
Host permission — access limited to this URL pattern.
Access to Sensitive Domains
Risk Factor
Medium
This extension requests access to sensitive domains: https://www.amazon.com/*, https://completion.amazon.com/*, *://*.amazon.com/*, *://*.amazon.com.mx/*, *://*.amazon.com.au/*, *://*.amazon.co.uk/*, *://*.amazon.ca/*, *://*.amazon.de/*, *://*.amazon.fr/*, *://*.amazon.in/*, *://*.amazon.nl/*, *://*.amazon.it/*, *://*.amazon.co.jp/*, *://*.amazon.at/*, *://*.amazon.es/*, *://*.amazon.cn/*, *://*.amazon.ae/*, *://*.amazon.com.br/*, *://*.amazon.eg/*, *://*.amazon.sa/*, *://*.amazon.pl/*
  • 2 critical
  • 2 high

The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.

2 critical findings in this extension’s code

2 critical
2 high
6 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe

About this extension

Extract Amazon product titles, ASINs, details, images & videos to CSV/Excel—fast, free, and easy.

Read the publisher’s full description

Extract Amazon product data instantly with 10X’s free Amazon Product Scraper & Extractor. Download complete product details in CSV or Excel quickly and effortlessly with 10XProfit.io. 👉 Amazon Product Scraper & Extractor | 10X Scrape and export Amazon product data—fast, simple, and free! With 10X’s Amazon Product Scraper & Extractor, you can gather complete product information from any Amazon page in one click. Export product titles, ASINs, prices, descriptions, images, videos, and more into CSV or Excel for research, listing optimization, competitor analysis, and business growth. Perfect for Amazon sellers, dropshippers, marketers, and researchers looking for accurate, structured product data to boost sales, monitor pricing, and track market trends. 👉 Quick Start Guide Grow your Amazon business with exportable product data- no coding required: 1. Visit 10XProfit.io or the Chrome Web Store 2. Install the Amazon Product Scraper & Extractor | 10X Chrome extension 3. Open any Amazon product page 4. Click “Scrape & Export Data” to download complete product details in CSV or Excel Fast, reliable, and effortless—make product research 3X smarter. 👉 Key Features ✔ Product Data: ➞ Titles, ASINs, prices, descriptions, and product specifications ✔ Product Media: ➞ Product images, description images, review images ✔ Videos: ➞ Extract and download product videos (if available) ✔ Scraping & Download Options: ➞ One-click scraping from any Amazon product page ➞ Export data in CSV or Excel (.xlsx) ✔ Media Download Options: ➞ Images: Download individually or in bulk ➞ Videos: Download individually or in bulk 👉 Additional Benefits: ➞ Supports multiple Amazon marketplaces ➞ Lightweight, clean, and user-friendly interface ➞ Ideal for product research, listing optimization, and trend tracking ➞ Make faster, data-driven business decisions 👉 Who Uses It and Why ➞ Amazon Sellers – Save hours of manual work and discover winning products quickl ➞ Dropshippers – Collect ASINs, images, and descriptions efficiently ➞ eCommerce Marketers – Analyze competitors, pricing trends, and product performance ➞ Product Researchers – Access structured data for demand forecasting and planning ➞ Affiliate Marketers – Promote accurate listings to increase conversions ➞ Data Analysts – Leverage CSV/Excel files for trend analysis and insights 👉 FAQs Q1. What does this extension do? - Extracts Amazon product data including title, ASIN, price, images, description images, review images, and videos, exporting all into CSV or Excel. Q2. Is it free? - Yes! Core features are free. Paid plans may offer advanced options. Q3. Which file formats are supported? - CSV and Excel (.xlsx) Q4. Do I need technical skills? - No. Just install, click, and export—beginner-friendly. Q5. Can it scrape bulk product data? - Yes. Open multiple product pages and extract all data efficiently. Q6. Which Amazon marketplaces are supported? - Works with Amazon.com, .co.uk, .in, .de, .ca, and more Q7. Can it extract videos? - Yes, product videos are included if available Q8. Is it safe and Amazon-compliant? - Yes, it only scrapes publicly available data on Amazon product pages Q9. Can I download images and videos in bulk? - Yes, you can download product images and videos either individually or all at once for faster workflow. Q10. Will this work on sponsored and organic listings? - Yes, the extension works on both sponsored and organic Amazon product listings. Supercharge your Amazon business with 10X. Use the Amazon Product Scraper & Extractor to download full product data, images, and videos—individually or in bulk—into CSV/Excel, save hours of research, and make smarter, data-driven decisions! 👉 Affiliate & copyright disclaimer 📣 Affiliate Disclosure: This extension and the 10Xprofit.io website may use affiliate links in accompanying documentation, tutorials, or marketing pages. If you click an affiliate link and make a purchase, we may receive a commission at no additional cost to you. We recommend products we believe offer value; however, please conduct your own research before any purchase. 📣 Copyright & Usage Notice: All product images, logos, brand names, videos, and other assets on Amazon are the property of their respective owners. You are responsible for ensuring you have the necessary rights, licenses, or permissions before downloading, storing, sharing, or using any media. This extension is a tool that facilitates downloading; it does not grant any rights to the content. Usage must comply with Amazon’s Terms of Service, applicable marketplace policies, and all relevant copyright, trademark, and intellectual property laws. Official Website: https://10xprofit.io/ Support: https://10xprofit.io/contact

User reviews

Extension files

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

URLs
6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

No URLs found
No IP addresses found

2 critical findings in this extension’s code

2 critical
2 high
6 indicators
1 version analysed

Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.

Unlock this report — $4.99Start 7-day trial — all reports
One-time payment · Secure checkout by Stripe
Version
Size
Verdict
Findings
Permhash
3.0.1
Latest
0.24 MBMalicious0
d18bf2acdb07b06b29e3480593a9fdcc5187ce0e789897f4a95733aea5c84a6f
Showing 1 to 1 of 10 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

Store rankings

Where this extension appears in store category, collection and keyword rankings.