Research
We took apart 40 Shopify spy extensions. Here's what they do when you're not looking.
Almost every store-research extension asks for one enormous permission: the right to run on every page you visit. We unpacked 40 of the most popular ones and read the code to see what that access is actually used for. Some of it is not what you'd expect.
If you do product research, you probably have three or four of these installed right now: the store inspectors, the ad-library scrapers, the "find winning products" tools. They're useful. They're also, technically, some of the most invasive software on your computer — because to read a Shopify store's public data, most of them request permission to read anything you load in your browser.
A Chrome extension's real intentions are not in its store listing. They're in its code, which anyone can unpack and read. So we did — 40 extensions, manifests and scripts, one at a time. We were looking for one thing: what happens to the access you grant when you click "Add to Chrome."
Most were fine. Several were not. Here are the patterns worth knowing about — and, at the end, exactly how to check any extension yourself in about five minutes.
The patterns
1. It records your entire browsing session — not just Shopify
One widely-installed store inspector bundles a full session-replay library and
points it at its own servers. Session replay captures what you see and do on a page — scrolls, clicks,
form fields — and it was wired to run on <all_urls>, i.e. everywhere, not only on
the Shopify stores the tool is for.
You install it to inspect competitors. It's watching you inspect them — and watching everything else you do in the browser, too.
2. It reads the email you're signed into Chrome with — silently
Chrome exposes a way for extensions to read the Google account email of the signed-in user. Used properly it shows a consent prompt. Several tools we looked at read it through a path that shows no prompt at all, then quietly attach that address to their marketing list. You never agreed to hand over your email. You just installed a store inspector.
3. One exfiltrated a live login session to a private server
The most serious thing we found reads a logged-in social account's session cookie — the token that is your login — and sends it, in plain text, to a hard-coded endpoint the developer controls. Anyone holding that token holds the account.
We're not naming this one yet: it's a live security issue, and we've reported it to Google first so it can be pulled before it's publicized. This is the responsible order, and it's the order we'd want someone to use if it were our users.
4. It injects a fake "button" into an unrelated site
One tool injects an element into ChatGPT's sidebar, styled to look like a native menu item, labelled with a tiny "Ad." It links to an install page for another product. You're using ChatGPT; a Shopify extension you forgot you installed is quietly placing ads inside it.
5. It rewrites your own links to earn a commission
A few tools intercept your normal browsing and silently rewrite outbound links — appending their own affiliate tags to Amazon URLs, or redirecting AliExpress navigation through their referral codes. You clicked your link. They changed the destination so they'd get paid on your purchase. No disclosure, no opt-out.
6. The headline number is frequently fiction
"Live sales" is the most-wanted feature in this category, and the most faked. We found a tool that flags any product edited today as sold today — a price change reads as a sale. Another ships "Pro" analytics charts that are hard-coded percentages of the real total, not measured data. A published "sales tracker" tracks nothing; it's a stub that opens a marketing page.
If a tool won't show you how it arrived at a number, assume it can't.
How to check any extension yourself
You don't need to read code to catch most of this. The permissions tell you most of the story, and they're public. Five minutes:
- On the extension's Chrome Web Store page, scroll to "This extension can read and change…" Anything that says "on all sites" or "your data on all websites" is asking to run everywhere. For a tool that only reads Shopify stores, ask why it needs that.
- Go to
chrome://extensions, click Details, and read Site access. Prefer tools set to "On specific sites," not "On all sites." - Watch for the permissions
identity,cookies,management, andwebRequest. None are required to read a public storefront. Each has a legitimate use — and an invasive one. - Search the listing and the developer's site for the words "affiliate" and "session." Honest tools that use affiliate links say so. The ones that don't, don't.
- For any number a tool reports as fact, ask where it comes from. A tool that shows its working is a tool you can trust with the ones you can't check.
The rule of thumb
A store-research tool needs to read store pages. It does not need to watch you everywhere, read your identity, or touch your logins. When it asks for more than the job requires, the extra access is the product — and you're not the customer.
What we chose instead — and how to verify it
We build one of these tools, MurmSpy, so treat this section with the skepticism it deserves and check it yourself using the steps above. Here's what you'll find:
Verifiable, not a promise
No access to "all sites" — MurmSpy runs on Shopify and TikTok Shop pages only, plus a one-click,
you-initiated scan for custom domains. No identity, no cookies, no
management permission. No session recording. No affiliate links, ever. Every estimate is
labelled with what it's derived from. The whole thing is about 200 KB and computes on your machine —
there's no server collecting what you look at, because there's no server.
Those aren't virtues we're claiming — they're consequences of an architecture you can inspect with the same five-minute check we just described. That's the point of the check: it works on us too.
MurmSpy
Store analytics for Shopify and TikTok Shop — best sellers, pricing, app & theme detection, a watchlist that flags what changed, and honestly-labelled estimates.
Free, scoped permissions, no account. See MurmSpy →