What our analysis found

Amazon Seller Assistant - 10Xprofit Amazon Seller Tools (FB… is rated malicious by Extension Auditor. Our code review reported 3 findings (1 critical, 2 high), led by other. Its permissions mean it can inject scripts into pages.

Key findings

• critical· other —Every anchor on 23 Amazon storefronts has its affiliate `tag` query parameter overwritten with the extension author's own Associates ID; because the condition is `tag!== "10xprofit-20"` it strips and replaces tags that already belong to Amazon itself or to another affiliate, diverting commission on purchases the user makes through those links. The behaviour runs silently at document_end and after every DOM mutation, is on by default, and nothing in the CWS listing, the popup settings, or the (missing) discloses it.
• high· other —The affiliate-rewrite function is wired to a subtree MutationObserver so that any dynamically injected or restored Amazon link is re-tagged, defeating Amazon's own link rendering and making the substitution persistent for the whole session. Although `affiliateLinks` is read from chrome.storage.sync, 's settingsMap contains no control for it and no code path ever writes it, so the user has no way to turn the rewriting off.
• high· other —The bundled manifest does not match the published CWS manifest summary: it adds `clipboardWrite` (dropping `notifications`), adds `*://*. and `*:// host permissions plus every `completion.amazon.*` host, adds an entire second content-script block () that scrapes result pages, and widens web_accessible_resources from Amazon-only `images/*`+` ` to `<all_urls>` exposing `pages/*`. Exposing extension pages and scripts to every origin lets any website probe for and frame this extension, and the Google host access and scraper are not reflected in what the publisher disclosed on the store listing.

256-290 defines a hard-coded Amazon Associates tag ("10xprofit-20") and a function m() that rewrites EVERY <a> on 23 Amazon storefronts, replacing any pre-existing tag parameter rather than only filling empty ones; it is enabled by default (affiliateLinks:!0, line 261) and re-applied on every DOM mutation via the MutationObserver at line 832, while 's settingsMap exposes no affiliateLinks toggle and the "Affiliate Disclaimer" link in:263 points at, which does not exist in the package. That is commission hijacking, matching the IoC recorded for this ID. Other flows corroborate nothing malicious: the ecomstal-* POSTs go to first-party the amazon session-id cookie (:1854) is sent only to the same Amazon host's own endpoint, lens_scraper results are relayed to the extension's own (no off-device sink), and the document.cookie / new Function hits are axios and regenerator boilerplate. The publisher's malicious siblings and the 100%-flagged permhash cluster corroborate the call but are not its basis; the bundled manifest also diverges from the published listing (added clipboardWrite, hosts and <all_urls> web-accessible resources).