Is EuroSaver – Amazon Europe Price Comparison safe?
We analyzed EuroSaver – Amazon Europe Price Comparison version 1.4.7's actual code and gave it a 35/100 trust score. This price-comparison extension has…
Bottom line
This price-comparison extension has purpose-related Amazon access but also enables unexplained remote product scraping and persistent tracking, so caution is warranted.
What it can access
It can read and modify Amazon product, cart, and order pages across 22 marketplaces, which broadly fits its purpose but is extensive. [Q1][Q2] It also sends product activity to its service. [Q6]
Security weaknesses
A default-on background connection lets EuroSaver remotely make the extension fetch products across supported marketplaces, using the user's browser and network. [Q16][Q23]
Signs of misuse
The extension sends viewed products and a persistent identity to EuroSaver, while its server can request unrelated product lookups beyond the current page. [Q6][Q12][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests activeTab, storage, and content/host access to 22 Amazon marketplaces. That scope fits an Amazon comparison tool and excludes unrelated sites, but it reaches product, cart and order pages and supports background cross-market requests.
Declares six content scripts and matching host permissions for named Amazon domains, plus activeTab and storage. — manifest.json:1-258
Which websites can it run on, and can it read or change what appears on those pages?
On Amazon it reads product, cart and order-page page data, watches page mutations, changes URL filters, applies dark styling, and injects comparison, basket, copy, filter and navigation UI.
Tracks Amazon product-page navigation, extracts ASIN/name/price data, and inserts price-comparison and advertising UI. — assets/src/entries/contentScript/primary/main-DMM7u-gr.js:1
Reads selected cart item ASINs, names and quantities and inserts a comparative basket panel. — assets/src/entries/contentScript/basket-view/main-CmPNizHf.js:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Matches the displayed Amazon order-number format and adds a local copy button; it does not gather surrounding account details. — assets/src/entries/contentScript/order-copy-button/main-C1PX6dI2.js:1
Restricts cart extraction to item ASIN, product name, quantity, selected/removed state, and displayed pricing comparisons. — assets/src/entries/contentScript/basket-view/main-CmPNizHf.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
The only named permissions are activeTab and storage. — manifest.json:177-180
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
A user-clicked order-copy button writes the detected Amazon order number to the clipboard. It does not read clipboard contents or access files, camera, microphone, location, screen capture, or native applications.
Calls navigator.clipboard.writeText(orderNumber), with a temporary textarea copy fallback, only from the injected button click. — assets/src/entries/contentScript/order-copy-button/main-C1PX6dI2.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends viewed-product identifiers/names/countries and observed prices to eurosaver.net, fetches exchange rates from GitHub, and sends signed public product data from server-requested Amazon lookups over a EuroSaver WebSocket.
Defines eurosaver.net banner and price endpoints and a raw.githubusercontent.com exchange-rate source. — assets/web-app-CMyrncBK.js:1
Connects to realtime.eurosaver.net/ws, fetches Amazon pages for requested ASINs, and returns signed price/name/store/image/shipping/currency responses. — assets/src/entries/background/service-worker-Dms-Sb6e.js:18
Does it download or run code, settings, or instructions supplied by a remote server?
EuroSaver's server supplies banner data and price-lookup jobs, and GitHub supplies exchange rates. Jobs can direct which ASIN and country the extension fetches, but responses are validated data rather than executable code.
Validates only PRICE_REQUEST and COUNTRY_PRICE_REQUEST schemas containing request ID, ASIN and optional country before acting. — assets/src/entries/background/service-worker-Dms-Sb6e.js:1, 18
Fetches server-selected banner data for injection into the product comparison UI. — assets/spinner-BWF5GJOy.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically reports product prices and, with a default-on setting, repeatedly reconnects to a server that can trigger Amazon fetches unrelated to the user's current page. Local page enhancements also run without a toolbar click.
The default settings object sets enableWsClient, in-page view, price indicator, basket view and other integrations to true. — assets/index-BNtcZBA6.js:1
Loops while enableWsClient is true, reconnecting one second after each WebSocket session ends and servicing remote requests. — assets/src/entries/background/service-worker-Dms-Sb6e.js:18
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no settings override, search provider, proxy, privacy, management, or debugger capability. — manifest.json:1-258
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Application bundles are minified and include React, schema validation, page parsing, cryptography and browser-polyfill code, but services and security-relevant workflows remain readable; no encrypted or packed data was found.
Lists minified background, React UI, DOM parser, styling and content-script bundles among 1.8 MB of unpacked files. — inventory.json:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Statically imports the packaged background bundle. — serviceWorker.js:1
Dynamically imports a fixed chrome.runtime.getURL path to a packaged content bundle, not a network URL. — src/entries/contentScript/primary/main.js:1
Does it track the websites, pages, searches, or links you visit?
It does not track general browsing, but Amazon product views reveal the product ASIN, name and marketplace to EuroSaver through banner requests and price-posting behavior.
On recognized product navigation, extracts ASIN/name/country, requests a banner, and tells the worker to read and post price observations. — assets/src/entries/contentScript/primary/main-DMM7u-gr.js:1
Places ASIN, product name and Amazon country into the eurosaver.net /api/banner query string. — assets/web-app-CMyrncBK.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates and persists an Ed25519 private key; the corresponding public key is sent as userId and each WebSocket response is signed, providing a stable identity across sessions.
Loads userPrivateKey from local storage or generates and stores one, derives its public key, and includes that public key in signed AUTH and price responses. — assets/src/entries/background/service-worker-Dms-Sb6e.js:18
Does it send cookies, session details, authentication data, or page contents elsewhere?
Amazon product interests and public catalog data are sent to EuroSaver with a persistent signed user ID. Order numbers, cart quantities, credentials, cookies and payment details were not found in outbound data.
Defines outbound payloads as public product price/name/store/image/shipping/currency records plus userId/callbackId and posts price/currency observations to EuroSaver. — assets/src/entries/background/service-worker-Dms-Sb6e.js:1, 18
Does it record typing, form entries, clipboard contents, or screenshots?
It reads visible order numbers and watches cart item/quantity/selection changes, and it can copy an order number after a user click. It does not monitor keyboard input, passwords, payment fields, clipboard contents, or screenshots.
Extracts only text matching Amazon's order-number pattern and copies it when the added button is clicked. — assets/src/entries/contentScript/order-copy-button/main-C1PX6dI2.js:1
Observes the cart form for product selection, ASIN, name and quantity changes to refresh comparisons. — assets/src/entries/contentScript/basket-view/main-CmPNizHf.js:1
Can a website or remote server send commands that make the extension take actions?
The EuroSaver WebSocket server can command the extension to fetch any ASIN across all supported Amazon countries or one chosen country, after which the extension returns signed parsed results.
Accepts schema-validated PRICE_REQUEST and COUNTRY_PRICE_REQUEST messages, performs the requested Amazon fetches, and sends callback-linked responses. — assets/src/entries/background/service-worker-Dms-Sb6e.js:1, 18
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It injects server-provided banner ads and price-comparison links into Amazon product/cart pages and changes a search URL when its sale/shipping filter is clicked. Marketplace affiliate-tag fields are empty in this package, so no affiliate-code hijacking was found.
Fetches banner data from EuroSaver and renders a chosen ad inside the extension's product-page UI. — assets/spinner-BWF5GJOy.js:1
Defines supported marketplaces with empty tag values for generated Amazon comparison links. — assets/index-CR5LI4Lz.js:1
Adds or removes the Amazon emi search parameter only when the user clicks its added filter. — assets/src/entries/contentScript/sale-and-shipping-filter/main-CRlr5h7R.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests neither proxy, webRequest, declarativeNetRequest, debugger nor downloads access. — manifest.json:177-180
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Host access is limited to public Amazon HTTPS/HTTP sites and no nativeMessaging permission is declared. — manifest.json:1-258
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Serializes fixed AUTH/price response schemas, signs their bytes, and sends signature plus data; inbound messages are JSON schema-validated and never evaluated. — assets/src/entries/background/service-worker-Dms-Sb6e.js:1, 18
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Web-accessible resources are limited to packaged UI modules/assets on Amazon matches and no externally_connectable entry exists. — manifest.json:206-258
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Remote schemas choose product/country only; they cannot provide scripts, selectors, arbitrary URLs or free-form commands. — assets/src/entries/background/service-worker-Dms-Sb6e.js:1, 18
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
A default-on background feature uses the user's browser, bandwidth and IP as a remotely dispatched Amazon price scraper. Jobs may fetch one product in one country or fan out across every supported marketplace, independent of current browsing.
Sets enableWsClient true in default settings. — assets/index-BNtcZBA6.js:1
PRICE_REQUEST maps the requested ASIN across every marketplace with Promise.allSettled; COUNTRY_PRICE_REQUEST fetches the selected marketplace and sends results back. — assets/src/entries/background/service-worker-Dms-Sb6e.js:18
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Reads cart item state and listens for changes without writing existing input values or submitting the cart form. — assets/src/entries/contentScript/basket-view/main-CmPNizHf.js:1
User-clicked filtering edits the current URL's emi parameter rather than a form action or checkout value. — assets/src/entries/contentScript/sale-and-shipping-filter/main-CRlr5h7R.js:1