Is 西柚洞察(原西柚找词)——每小时亚马逊关键词排名更新 safe?

Medium risk

西柚找词 is medium risk. We observed the extension request URL-pattern rules from plugin-api.xydc.com/v3/plugin/availableUrls on Amazon, adding the page URL to headers. Returned arrays become regexes deciding if keyword, ranking, product, or ad overlays appear.

huangyuhaov2.5.0Chrome Web Store
45Risk
Who publishes it

huangyuhao - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
huangyuhao

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote Rules Gate Amazon Page Overlays

We observed the extension request URL-pattern rules from plugin-api.xydc.com/v3/plugin/availableUrls on Amazon, adding the page URL to headers.

Returned arrays become regexes deciding if keyword, ranking, product, or ad overlays appear.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You open a supported Amazon page.

The extension did this

The extension asks its plugin API for URL-pattern rules and checks your page against the returned rules.

A matching rule determines whether the page gets a keyword, ranking, product-detail, or advertising overlay.

Captured request
GEThttps://plugin-api.xydc.com/v3/plugin/availableUrls

Returned JSON arrays named bestSeller, newReleases, searchTermSearchResult, asinDetail, and advertisingManager.

Fields and rule groups used by the activation request
  • Current Amazon page URL
    https://www.amazon.com/dp/B0C7Q9MJ8S?psc=1

    Lets the request include the exact Amazon page you are viewing when the extension asks for activation rules.

  • Product-detail rules
    asinDetail

    Controls whether a product-detail overlay appears when your page path matches a returned pattern.

  • Ranking-page rules
    bestSeller, newReleases

    Controls whether best-seller or new-release ranking overlays appear on matching category pages.

  • Search and ad rules
    searchTermSearchResult, advertisingManager

    Controls whether keyword-search or advertising-manager overlays run for the current page.

The code that does this

The shipped code fetches remote patterns and gates overlay creation

Readable version

Service worker API base URL and allowed path

background/index.js
const Pt = ["/v2/system/*", "/v2/account/info", "/v3/system/*", "/v3/account/info", "/dp/*", "/v3/plugin/availableUrls", "/v3/asins/plugin/productInfo/parseRule", "/v3/asins/bsr/categories/*"],  Dt = e => Pt.some(r => new RegExp(r).test(e)),  ye = P.create({    baseURL: "https://plugin-api.xydc.com",    timeout: 2e4,    adapter: St  }),  Ut = P.CancelToken,  We = Ut.source();

API client method

assets/index.72b718c2.js
class jF {  constructor(e) {    k(this, "getAvailableUrls", () => this.service({      url: "/v3/plugin/availableUrls",      method: "GET"    }));    this.service = e, this.service = e  }}

Current URL header, response mapping, and overlay gate

content/index.js
uw = r => {  var e;  return {    ...r,    headers: {      ...(e = r.headers) != null ? e : {},      "request-url": window.location.href    }  }},Sf = r => new RegExp(r),PPe = async () => {  const r = await yB.getAvailableUrls();  if (r.clientCode != 0) return {    asinDetailRegExpList: [],    bestSellersRegExpList: [],    newReleasesRegExpList: [],    searchTermSearchResultRegExpList: [],    adCampaignRegExpList: []  };  const e = (r.data.asinDetail || []).map(Sf),    t = (r.data.bestSeller || []).map(Sf),    n = (r.data.newReleases || []).map(Sf),    a = (r.data.searchTermSearchResult || []).map(Sf),    i = (r.data.advertisingManager || []).map(Sf);  return {    asinDetailRegExpList: e,    bestSellersRegExpList: t,    newReleasesRegExpList: n,    searchTermSearchResultRegExpList: a,    adCampaignRegExpList: i  }}, FPe = (r, e) => {  const t = Object.keys(r);  for (let n = 0; n < t.length; n++) {    const a = t[n],      i = r[a];    if (xf(i, e)) return !0  }  return !1}, OPe = async () => {  const r = location.pathname,    e = await PPe();  if (!FPe(e, r) || (await mB(), await _B(), await bB(), await SB(), await FL(), RPe().create(), !xB.value)) return;  LPe(e, r).create()}, BPe = () => {  const r = location.origin;  /amazon/.test(r) && OPe()}
Hosts involved in the observed activation flow
    • plugin-api.xydc.com

    Receives the GET request for extension URL-pattern configuration and returns the rule arrays used for overlay activation.

    • www.amazon.com

    A supported shopping page origin where the content script runs and evaluates the current path against returned rules.

Updated 30 September 2026cnnnoeoofhlgpigbpfefflabjlhoacoj