Extension Auditor
Extension Auditor
Sign Up

sellhack

ID: dmcmgkmooimomjcinimbhfoephdhmgbc

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status
Removed
Version
5.0.3
Size
0.07 MB
Rating
4.2/5
Reviews
50
Users
5,000
Type
Extension
Updated
Feb 28, 2023
Category
Productivity Tools
Price
Free
Featured
No
Visibility
Listed
Mature
No
By Google
No
Trusted
No
Download CRX
Chrome Web Store
Report Issue

Publisher Contextual Analysis

Author
https://sellhack.comView Profile
Privacy
Privacy Policy
Help
Help Center
Country
US
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
No
Mailbox exists
Yes
Address
150 Center St #796 Chardon, OH 44024-1179 US
Website
Visit
Total Extensions
1
Active
0
Obsolete
1
Listed
1
Unlisted
0
Total Users
5,000

Social discovery

Sales Helper - Social profiles add on to gather additional info about leads - use SellHack from any website! NEW in version 4.0+ --- Replyify Integration -- Learn more at https://replyify.com

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
declarativeNetRequest
Permission
Critical
This permission allows the extension to define rules to block, redirect, or modify network requests. Rated Critical because it can control all network traffic, potentially blocking security updates or redirecting to malicious sites.
*://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.

By severity

Critical3
High4
Medium2
Low0

Versions scanned

Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension VersionCode Review Findings
5.0.19

Files with findings

2 distinct paths — top paths by unique finding count:

  • frame.js7
  • background.js2
S.No.
Category
Severity
File
Summary
Found in Version
1Credential Theft
critical
frame.js (line 1603)The extension reads document.cookie on LinkedIn pages to extract the JSESSIONID session token, which doubles as LinkedIn's CSRF token. This token is then injected into all subsequent API requests via getAPIHeaders(), …
5.0.1
2Data Exfiltration
critical
frame.js (line 1247)The extension serializes the collected LinkedIn profile object (containing name, email, Twitter handle, location, company, title, profile image URL, and LinkedIn member ID) into JSON and appends it as a URL parameter …
5.0.1
3Unauthorized Data Collection
critical
frame.js (line 1432)Using the stolen JSESSIONID/CSRF token, the extension makes authenticated cross-origin XHR calls to LinkedIn's private internal Sales Navigator and Voyager APIs with withCredentials: true. This allows the extension to…
5.0.1
4Remote Code Loading
high
background.js (line 1)The background service worker fetches a remote configuration endpoint at app.sellhack.com with credentials: 'include' before deciding which scripts to inject. This gives the remote server the ability to dynamically to…
5.0.1
5Unauthorized Data Collection
high
frame.js (line 1524)The extension silently queries LinkedIn's private salesApiAccess and salesApiPrimaryIdentity endpoints using the user's session credentials. The identity token retrieved is then used in subsequent API requests to furt…
5.0.1
6Unauthorized Data Collection
high
frame.js (line 333)The extension defines a profile object that aggregates a broad set of personally identifiable information (PII) from LinkedIn profiles: full name, email address, Twitter handle, geographic location, profile image, com…
5.0.1
7Unauthorized Data Collection
high
frame.js (line 1009)The extension extracts email addresses and Twitter account handles from LinkedIn's internal contactInfo API response data, fields that LinkedIn intentionally restricts and only surfaces to authorized API clients. Harv…
5.0.1
8Code Injection
medium
background.js (line 72)The extension uses chrome.scripting.executeScript with host_permissions of *://*/* to inject its script bundle into any tab. The decision of which scripts to inject is partially determined by the remote config-check r…
5.0.1
9Tracking
medium
frame.js (line 67)Every page load encodes the current URL and transmits it to app.sellhack.com as the parent parameter when loading the remote iframe. This provides the remote server with a complete browsing history of LinkedIn URLs vi…
5.0.1
URLs
17
IPv4
0
IPv6
0

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
app.sellhack.com/extension/config-checkhttps://app.sellhack.com/extension/config-check
www.w3.org/1999/02/22-rdf-syntax-nshttp://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com/xap/1.0/http://ns.adobe.com/xap/1.0/
ns.adobe.com/xap/1.0/mm/http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com/xap/1.0/sType/ResourceRefhttp://ns.adobe.com/xap/1.0/sType/ResourceRef#
www.w3.org/2000/svghttp://www.w3.org/2000/svg
clients2.google.com/service/update2/crxhttps://clients2.google.com/service/update2/crx
*.sellhack.com/*https://*.sellhack.com/*
app.sellhack.com/extension/loadhttps://app.sellhack.com/extension/load
www.linkedin.com-http://www.linkedin.com
Showing 1 to 10 of 20 rows
Rows per page:

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In
No IP addresses found
Showing 1 to 4 of 10 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files (scanned top 25 shared text files)

No comparable text files found between these versions.

Browse and explore files within this extension package

Gain full insight into all external connections.

Upgrade for full visibility.

Sign In