Is 亚马逊选品助手 - 免费Amazon选品与数据分析 safe?
亚马逊选品助手 - 免费Amazon选品与数据分析 is high risk. We observed the extension fetch a config file at startup and install 11 network rules under all-site access, including one that blocks all requests to a rival service and several that alter headers on major shopping sites.
Who publishes it极鲸云 - 8 other listings from the same operator, 1 of them carrying a finding
极鲸云 - 8 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
8 other listings published from this account, 166k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
A remote server pushes network-blocking rules across every site you visit
We observed the extension fetch a config file at startup and install 11 network rules under all-site access, including one that blocks all requests to a rival service and several that alter headers on major shopping sites.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
The extension's background service worker starts, which happens automatically on browser launch or install.
A remote server returns a set of network rules, and the extension installs them to run on every site you visit, with no review of what the rules do.
Returned 11 declarativeNetRequest rule objects plus a list of rule IDs and a refresh delay. A live query of chrome.declarativeNetRequest.getDynamicRules() immediately afterward confirmed those exact 11 rules were installed and active.
- Block a rival serviceaction: block, urlFilter: api.temushuju.com
One rule (ID 26) blocks all requests to a competing service, api.temushuju.com, disabling it while this extension is installed.
- Rewrite request headersAmazon, Temu, 1688, Taobao, Tmall, Pinduoduo
Several rules forge the Referer and Origin headers on requests to major e-commerce sites, affecting how those sites attribute traffic.
- No local review of new rulesaddRules: response.data.rules (unfiltered)
The extension applies whatever the server sends without checking the rule's action type, target domain, or resource type first.
Config fetch and unrestricted rule install in background.js
(async () => { const existing = await chrome.declarativeNetRequest.getDynamicRules(); try { const res = await fetch(`https://api.amazonshuju.com/api/v1/plugin/config?version=${manifest.version}`); const config = await res.json(); installedRules = config.data.rules; installedRuleIds = config.data.ruleIds; const refreshDelay = config.data.delay; reapplyRules = debounce(reapplyOnNavigation, refreshDelay); chrome.webNavigation.onCompleted.addListener(reapplyRules); chrome.webNavigation.onBeforeNavigate.addListener(removeRulesBeforeNav); // No validation of config.data.rules before installing them for every site: chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: existing.map(r => r.id), addRules: config.data.rules }); chrome.storage.sync.set({ pluginConfig: config.data }); } catch (e) { chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: existing.filter(r => r.action.type === "redirect").map(r => r.id) }); }})();- api.amazonshuju.com
Serves the plugin config that determines which network rules get installed on every site.
- api.temushuju.com
Targeted by a block rule from the remote config; requests to this competing service are dropped entirely.
- amazon.com
- 1688.com
- taobao.com
Referer/Origin headers on requests to this domain are rewritten by a remote-supplied rule.