Is AliSold卖家助手 - 免费图搜同款、查侵权 safe?

High risk

AliSold卖家助手 - 免费图搜同款、查侵权 is high risk. AliSold fetches rule configuration from api.alisold.com and applies the returned declarativeNetRequest rules with access to all sites. These remote rules can match browsing URLs and request headers across the extension's host access.…

极鲸云v1.0.2Chrome Web Store
72Risk
Who publishes it

极鲸云 - 8 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
极鲸云
Website
www.yuque.com/geekbi-com/alisold

Same store account

8 other listings published from this account, 164k+ users between them. 2 of them carry a finding.

Temu选品助手100k+LowShein选品助手 - 免费希音选品与数据分析40k+HighShopee选品助手 - 免费虾皮选品与数据分析10k+Medium亚马逊选品助手 - 免费Amazon选品与数据分析8k+HighTiktok选品助手 - 免费Tiktok选品与数据分析2k+Medium速卖通选品助手 - 免费AliExpress选品与数据分析2k+Low2 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote AliSold config installs request rules across all sites

AliSold fetches rule configuration from api.alisold.com and applies the returned declarativeNetRequest rules with access to all sites.

These remote rules can match browsing URLs and request headers across the extension's host access.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

The extension fetches remote configuration for its installed version.

The extension did this

It applies the returned declarativeNetRequest rules under all-site host access.

Captured request
GETapi.alisold.com/api/v1/plugin/config
Fields affected by the remote rules
  • Page URL
    https://example.com/products/123 (illustrative)

    URLs determine which browsing requests a remote rule can match or modify.

  • Request headers
    User-Agent: Chrome; Accept-Language: en-US (illustrative)

    Headers add browser, language, session, or request context that rules can inspect or change.

What it can do

Permissions this extension asks for, as declared in version 1.0.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Add items to the right-click menu

    contextMenus

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

  • Run its own code inside the pages you visit

    scripting

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

declarativeNetRequestWithHostAccess
Updated 30 September 2026lpnhifgofkablmicbhngmdmjmajgcced