Is Boss Plus safe?
Boss Plus fetches a proxy script from yiban.io and can set it as the browser-wide Chrome proxy.
When the vendor's runtime config enables an upgrade check and a newer version is listed, the extension tests connectivity, downloads a PAC script from yiban.io and applies it to all regular browsing. The script content is controlled by the vendor, is re-fetched every 30 minutes, and is removed only if the post-set connectivity check fails.
Strong link to a flagged operator: 1 of the 5 other listings from the same operator is rated high or critical for malicious behaviour. Flagged: 壹伴 (high).
Who publishes it民营企业 - 5 other listings from the same operator, 2 of them carrying a finding
民营企业 - 5 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
5 other listings published from this account, 231k+ users between them. 2 of them carry a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Extension can install a vendor-hosted PAC script as the browser-wide proxy
Code analysis shows the extension can fetch a PAC script from yiban.io and set it as the proxy for all browsing, when the vendor's runtime config enables it.
The script content is not pinned.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
The vendor runtime config reports a newer version with the upgrade probe enabled.
The extension polls bms.miemie.la/bms_api/public/extension-runtime-config.
The extension fetches a PAC script from yiban.io and sets it as the browser proxy.
This happens only if http://clients2.google.com/ does not return 404.
Proxy start flow and PAC installation
Start flow, readable
background.jsasync function startExtensionUpgradeProxy(reason) { if (starting) return false; starting = true; try { // 1. If Google's update endpoint answers 404, do nothing. if (await checkExtensionUpgradeConnectivity()) return false; // 2. Otherwise download the PAC text from yiban.io. const pac = await ensureExtensionUpgradePacScript(false); if (!pac) return false; // 3. Install it as the regular-scope proxy. if (!await setExtensionUpgradeProxyConfig(pac)) return false; // 4. Keep it only if the connectivity check now passes. if (await checkExtensionUpgradeConnectivity()) return true; await clearExtensionUpgradeProxyConfig(); return false; } finally { starting = false; }}Proxy set call, readable
background.jschrome.proxy.settings.set({ value: { mode: 'pac_script', pacScript: { data: pacText } }, scope: 'regular'}, callback);- PAC sourcehttps://yiban.io/extension/proxy.pac?t=huiyi
The rules that decide where your traffic goes come from a server the vendor controls.
- Runtime config flags
The vendor server decides whether and when this path runs.
- Reachability probehttp://clients2.google.com/ (expects 404)
The proxy is only applied if this Google URL fails to answer with a 404.
- Proxy scopescope: regular, mode: pac_script
The proxy covers all regular browsing, not just this extension's sites.
- yiban.io
Serves the PAC script that is installed as the browser proxy.
- bms.miemie.la
Vendor backend that returns the runtime config enabling the probe.
- clients2.google.com
Probed over HTTP; a non-404 result lets the PAC install proceed.
Every 30 minutes
While the PAC is active, the extension re-downloads it every 30 minutes, so the rules can change without an extension update.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Boss Plus contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- yiban.io
Boss Plus sends data to yiban.io. One other extension we have analysed sends data here.