Is 全蛙 · 多电商平台商品图下载助手 safe?

Medium risk

The extension reports the host and full URL of every page you visit to huoxiaqu.com.

A content script runs on all websites and passes each page's host and full URL to the background worker, which posts them to huoxiaqu.com's visitor record API. This happens alongside the extension's stated purpose of downloading product images from e-commerce sites.

Do Itv1.1.9Chrome Web Store
50Risk
Who publishes it

Do It - 7 other listings from the same operator, 6 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Do It

Same store account

7 other listings published from this account, 703 users between them. 6 of them carry a finding.

笔笔·bilibili视频批量下载助手224Medium阿蛙 · 阿里巴巴1688商品图下载助手189Medium京蛙 · 京东图片下载121Low淘蛙 · 淘宝天猫图片下载113Medium云链 - Tiktok视频下载39MediumTM蛙 · Temu图片下载17Medium1 more listing in the relationship graph, on paid plans →

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

huoxiaqu.com
Also called by 3 other listings: 希蛙 · 希音图片下载 shein image download, 界图-图片批量下载, 红鸟-X/推特下载助手

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Image downloader reports the address of every page you open to huoxiaqu.com

Code analysis shows a script on all sites sends each page's host and full address to huoxiaqu.com.

The extension's stated scope is seven shopping sites.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open any web page, including sites unrelated to shopping.

The extension did this

The page's host and full address, with query string, are sent to huoxiaqu.com.

The code that does this

Content script and background handler

Readable version

Content script

js/content.js
// matches: <all_urls>, run_at: document_endchrome.runtime.sendMessage({  type: 'recordVisitor',  fromChannel: 'content',  host: window.location.host,  url: window.location.href});

Background handler

js/background.js
case 'recordVisitor':  reportVisit(msg.fromChannel, msg.host, msg.url);  sendResponse({ success: true });  break;

API call

assets/request-BuCjc9tz.js
recordVisitor: (body) => request('/api/visitor/visitorRecord', { method: 'POST', body })
Fields in the visitorRecord request body
  • Page address
    https://example.com/search?q=flights

    Full address of the page, including any query string.

  • Site host
    example.com

    The site you are on.

  • User ID
    u_10482 (illustrative)

    Stored extension account identifier.

  • Session ID
    s_9f3a21 (illustrative)

    Stored session identifier, also sent as a header.

  • Channel
    content

    Which script reported the visit.

  • Paid status
    false (illustrative)

    Whether the account is a paid user.

Where the data goes
    • huoxiaqu.com

    Receives host and URL of visited pages via /api/visitor/visitorRecord.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.1.9. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on detail.1688.com

    *://*.detail.1688.com/*

  • Read and change your data on taobao.com

    *://*.taobao.com/*

  • Read and change your data on tmall.com

    *://*.tmall.com/*

  • Read and change your data on tmall.hk

    *://*.tmall.hk/*

  • Read and change your data on tmall.tw

    *://*.tmall.tw/*

  • Read and change your data on tmall.cn

    *://*.tmall.cn/*

  • Read and change your data on jd.com

    *://*.jd.com/*

  • Read and change your data on temu.com

    *://*.temu.com/*

  • Store data in your browser

    storage

  • Start, monitor and manage your downloads

    downloads

  • Watch every request your browser makes

    webRequest

  • Show a panel beside the page

    sidePanel

Where it sends data

Destinations our analysis observed 全蛙 · 多电商平台商品图下载助手 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • huoxiaqu.com

    全蛙 · 多电商平台商品图下载助手 sends data to huoxiaqu.com. 6 other extensions we have analysed send data here.

Updated 15 October 2026caijoglgdenekcgcdeafgecplckhimgk