Is 西柚洞察(原西柚找词)——每小时亚马逊关键词排名更新 safe?
西柚找词 is medium risk. We observed the extension request URL-pattern rules from plugin-api.xydc.com/v3/plugin/availableUrls on Amazon, adding the page URL to headers. Returned arrays become regexes deciding if keyword, ranking, product, or ad overlays appear.
Who publishes ithuangyuhao - no other listings under this identity
huangyuhao - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote Rules Gate Amazon Page Overlays
We observed the extension request URL-pattern rules from plugin-api.xydc.com/v3/plugin/availableUrls on Amazon, adding the page URL to headers.
Returned arrays become regexes deciding if keyword, ranking, product, or ad overlays appear.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open a supported Amazon page.
The extension asks its plugin API for URL-pattern rules and checks your page against the returned rules.
A matching rule determines whether the page gets a keyword, ranking, product-detail, or advertising overlay.
Returned JSON arrays named bestSeller, newReleases, searchTermSearchResult, asinDetail, and advertisingManager.
- Current Amazon page URLhttps://www.amazon.com/dp/B0C7Q9MJ8S?psc=1
Lets the request include the exact Amazon page you are viewing when the extension asks for activation rules.
- Product-detail rulesasinDetail
Controls whether a product-detail overlay appears when your page path matches a returned pattern.
- Ranking-page rulesbestSeller, newReleases
Controls whether best-seller or new-release ranking overlays appear on matching category pages.
- Search and ad rulessearchTermSearchResult, advertisingManager
Controls whether keyword-search or advertising-manager overlays run for the current page.
The shipped code fetches remote patterns and gates overlay creation
Service worker API base URL and allowed path
background/index.jsconst Pt = ["/v2/system/*", "/v2/account/info", "/v3/system/*", "/v3/account/info", "/dp/*", "/v3/plugin/availableUrls", "/v3/asins/plugin/productInfo/parseRule", "/v3/asins/bsr/categories/*"], Dt = e => Pt.some(r => new RegExp(r).test(e)), ye = P.create({ baseURL: "https://plugin-api.xydc.com", timeout: 2e4, adapter: St }), Ut = P.CancelToken, We = Ut.source();API client method
assets/index.72b718c2.jsclass jF { constructor(e) { k(this, "getAvailableUrls", () => this.service({ url: "/v3/plugin/availableUrls", method: "GET" })); this.service = e, this.service = e }}Current URL header, response mapping, and overlay gate
content/index.jsuw = r => { var e; return { ...r, headers: { ...(e = r.headers) != null ? e : {}, "request-url": window.location.href } }},Sf = r => new RegExp(r),PPe = async () => { const r = await yB.getAvailableUrls(); if (r.clientCode != 0) return { asinDetailRegExpList: [], bestSellersRegExpList: [], newReleasesRegExpList: [], searchTermSearchResultRegExpList: [], adCampaignRegExpList: [] }; const e = (r.data.asinDetail || []).map(Sf), t = (r.data.bestSeller || []).map(Sf), n = (r.data.newReleases || []).map(Sf), a = (r.data.searchTermSearchResult || []).map(Sf), i = (r.data.advertisingManager || []).map(Sf); return { asinDetailRegExpList: e, bestSellersRegExpList: t, newReleasesRegExpList: n, searchTermSearchResultRegExpList: a, adCampaignRegExpList: i }}, FPe = (r, e) => { const t = Object.keys(r); for (let n = 0; n < t.length; n++) { const a = t[n], i = r[a]; if (xf(i, e)) return !0 } return !1}, OPe = async () => { const r = location.pathname, e = await PPe(); if (!FPe(e, r) || (await mB(), await _B(), await bB(), await SB(), await FL(), RPe().create(), !xB.value)) return; LPe(e, r).create()}, BPe = () => { const r = location.origin; /amazon/.test(r) && OPe()}- plugin-api.xydc.com
Receives the GET request for extension URL-pattern configuration and returns the rule arrays used for overlay activation.
- www.amazon.com
A supported shopping page origin where the content script runs and evaluates the current path against returned rules.