Is 跨境电商ERP 辅助插件 safe?

Medium risk

The extension runs JavaScript sent by its vendor's server inside pages and returns cookies and localStorage on request.

This cross-border e-commerce ERP helper keeps a WebSocket open to the vendor's server. The server can tell it to open a page, run supplied code in that page with the user's logged-in session, and send back the result. The server can also request cookies and localStorage for any URL. Separately, it captures Takealot seller authorization headers for its Takealot features.

aebuyer630843v5.2.87Chrome Web Store
49Risk
Who publishes it

aebuyer630843 - no other listings under this identity, 3 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
aebuyer630843
Website
www.wxwerp.com/zh/download.html?tab=extension

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

d.3.cn
Also called by 4 other listings, including 大麦助手, 芒果店长, 芒果店长
desc.alicdn.com
Also called by 4 other listings, including votobo%EF%BC%9A%E8%B7%A8%E5%A2%83%E7%94%B5%E5%95%86%E4%BA%A7%E5%93%81%E5%BC%80%E5%8F%91%E5%88%86%E6%9E%90%E5%88%A9%E5%99%A8
dsc.taobaocdn.com
Also called by 4 other listings, including votobo%EF%BC%9A%E8%B7%A8%E5%A2%83%E7%94%B5%E5%95%86%E4%BA%A7%E5%93%81%E5%BC%80%E5%8F%91%E5%88%86%E6%9E%90%E5%88%A9%E5%99%A8

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Vendor WebSocket server can run its own JavaScript in a tab the extension opens

Code analysis shows a vendor server can send script text over a WebSocket.

The extension opens a tab at a server-chosen URL and runs that text in the page's MAIN world, then returns the result to the server.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

The vendor WebSocket server sends a task that includes a script string and a URL.

The extension did this

The extension opens a tab at that URL, runs the script in the page and sends back the result.

Code runs in the page's context, using whatever session the browser holds for that site.

The code that does this

Message handler passes server fields to the page-script runner

Readable version

WebSocket receive

background/index.js
this.ws = new WebSocket(h), ... this.ws.onmessage = async g => {  const d = JSON.parse(g.data);

Task dispatch

background/index.js
let s = Object.assign({}, r, as(r.moreSetting || r.MoreSetting));const { command: n, url: o, ..., pageScript: q, PageScript: F, pageScriptMaxSteps: Ae, PageScriptMaxSteps: ne } = s,  L = q || F || "", ie = Number(Ae || ne || 10);...if (L) {  wt({ url: o, active: o.includes("yangkeduo.com") || g, delay: u || 0, scroll: g,       timeout: ae, maxSteps: ie, pageScript: L, request: w });  return}
The code that does this

Tab creation and MAIN-world execution of the supplied string

Readable version
background/index.js
const d = await chrome.tabs.create({ url: e.url, active: e.active });...const F = await ls(r, e.pageScript, { step: q, state: D, url: v });...ls = (e, t, r) => new Promise((s, n) => {  const o = { target: { tabId: e }, world: "MAIN",    func: async (a, i) => await new Function("context", `"use strict"; return (async () => { ${a} })();`)(i),    args: [t, r] };  chrome.scripting.executeScript(o, ...)
Server-controlled task fields
  • pageScript
    return document.title

    JavaScript text the extension executes in the opened page.

  • url
    https://example.com/ (illustrative)

    Address of the tab the extension opens.

  • pageScriptMaxSteps
    10

    How many times the script may run in a loop.

  • Result
    Example Domain (illustrative)

    Value returned by the script, sent back to the server.

Remote endpoint
    • v3-ws-chrome.wxwerp.com

    WebSocket endpoint that delivers tasks and receives script results.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed 跨境电商ERP 辅助插件 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • v3-ws-chrome.wxwerp.com

    跨境电商ERP 辅助插件 sends data to v3-ws-chrome.wxwerp.com. No other extension we have analysed sends data here.

Updated 15 October 2026pnakgoppachenmifffpcfilndiineola