Is 元器件库存及价格全网搜 safe?

Medium risk

The extension installs network rules, opens tabs and fills search pages using instructions fetched from files.xiaolvji.com.

This electronic-component stock and price search tool downloads its configuration from files.xiaolvji.com on a recurring basis. That configuration supplies declarativeNetRequest rules that are applied on all sites during multi-search, URLs that are opened as background tabs, and selectors used to fill inputs and click elements in search tabs. None of these server-supplied values are checked against an allowlist.

TianWangLiJingv19.829.67.8Chrome Web Store
58Risk
Who publishes it

TianWangLiJing - 10 other listings from the same operator, 6 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
TianWangLiJing

Same store account

10 other listings published from this account, 20k+ users between them. 6 of them carry a finding.

网盘资源全网搜10k+Medium电子书全网搜8k+Medium%E5%AD%A6%E6%9C%AF%E8%B5%84%E6%BA%90%E5%85%A8%E7%BD%91%E6%90%9C%E7%B4%A21k+Medium划词搜索668Low购物比价原站全网搜193Medium企业背景信息查询168Medium4 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Search extension installs server-supplied network rules on all sites per search

Code analysis shows rules fetched from files.xiaolvji.com are installed verbatim as dynamic network rules on all sites before each multi-search, then cleared about 20 seconds later.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You run a multi-search from the popup or keyboard shortcut.

The extension did this

The extension installs network rules it downloaded from files.xiaolvji.com, on every site.

Rules are cleared again about 20 seconds later.

The code that does this

Rule list built from server config, then installed

Readable version

csl and engine networkRules become rules; only id and priority are overwritten

js/15.js
          var t = e.userConfigData.zdy;          let n = [];          var i, a, o = [],            s = [];          let r = 1;          for (i of n = void 0 !== e.userConfigData.csl ? e.userConfigData.csl : n) {            var c = i;            if (c.id = r, c.priority = 1, void 0 !== i.condition.urlFilter && "" !== i.condition.urlFilter) {              let e = !1;              for (var g of o)                if (g === i.condition.urlFilter) {                  e = !0;                  break                } e || o.push(i.condition.urlFilter)            }            s.push(c), r++          }          for (a of t)            if ("executeScript" === a[5] && void 0 !== a[6].networkRules && Array.isArray(a[6].networkRules) && 0 < a[6].networkRules.length)              for (var f of a[6].networkRules) {                var u, l = f;                l.id = r;                let e = !(l.priority = 1);                for (u of o)                  if (void 0 !== f.condition.urlFilter && u === f.condition.urlFilter) {                    e = !0;                    break

Installed before the search runs

js/15.js
                let n = C.l,                  i = C.w,                  a = parseInt(C.r);                try {                  se(function(t) {                    t && chrome.declarativeNetRequest.getDynamicRules(e => {                      e = e.map(e => e.id);                      chrome.declarativeNetRequest.updateDynamicRules({                        addRules: E.ruleList,                        removeRuleIds: e                      }, () => {                        x(a, n, i, t, 100)                      })
Server-controlled rule fields
  • Config source
    https://files.xiaolvji.com/addonUpdateLast.php

    Where the rules are downloaded from on each refresh.

  • condition
    { urlFilter, resourceTypes } (server chosen)

    Which requests a rule matches. Taken from the server reply.

  • action
    { type } (server chosen)

    What happens to matched requests, such as block, redirect or header change.

  • id / priority
    id: 1, priority: 1

    The only fields the extension sets itself.

When this fires

When a batch threshold is hit

Rules are added before each multi-search, and removed by a timer roughly 20 seconds after the last one.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Search extension opens a server-chosen page in a background tab

Code analysis shows a URL and time window from files.xiaolvji.com decide an extra background tab opened in the search window, with no validation of the URL.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You run a multi-search across several engines.

The extension did this

An extra tab to a server-chosen address opens in the background of the search window.

It only opens inside a start and end time set by the server.

The code that does this

Server glj entry opened as a tab

Readable version

Storing glj from the config reply

js/15.js
        }) : ae.remove("xl"), void 0 !== n.glj ? ae.set({          glj: n.glj        }) : ae.remove("glj"), void 0 !== n.di && n.di && chrome.storage.local.set({

Opening the selected entry

js/15.js
                ae.get(["glj"], function(e) {                  var t, n = (new Date).getTime();                  void 0 !== e.glj && void 0 !== e.glj[V] && Array.isArray(e.glj[V]) && 0 < e.glj[V].length && (t = e.glj[V].length, e = e.glj[V][n % t]) && void 0 !== e.data && void 0 !== e.st && void 0 !== e.et && e.data && n >= e.st && n < e.et && chrome.tabs.create({                    windowId: f.id,                    url: e.data,                    active: !1,                    index: u.length                  })                }), chrome.tabs.move(e[0].id, {                  index: -1                }, e => {
Fields of a server glj entry
  • data
    https://example-promo.test/landing

    The address opened in the new tab. Not checked by the extension.

  • st
    1767225600000

    Start time in milliseconds; earlier than this, nothing opens.

  • et
    1769904000000

    End time in milliseconds; at or after this, nothing opens.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Search extension types and clicks in search tabs using server selectors

Code analysis shows selectors from files.xiaolvji.com are passed to injected scripts that fill inputs and click elements in search tabs, and may navigate the tab to a server link.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You search a keyword in a group that includes a scripted engine.

The extension did this

The opened search tab has your keyword typed in and a button clicked, using selectors the server supplied.

The script may also set the tab address to a server-provided link.

The code that does this

Server selectors passed into executeScript

Readable version

Engine matched by reg_string; word and selectors returned

js/15.js
                  if ("executeScript" == a[e][5] && void 0 !== a[e][6].reg_string && a[e][6].reg_string && 0 <= n.indexOf(a[e][6].reg_string) && void 0 !== G[a[e][0]] && G[a[e][0]]) return (s = {}).word = G[a[e][0]], s.selectors = a[e][6], G[a[e][0]] = "", s;

Injection into the search tab

js/15.js
              if ("analogInput_init_error" === ne[i][a].status || "analogInput_init_timeOut" === ne[i][a].status) return;              ["ready", "executeScripting", "analogInput_init_succes"].includes(ne[i][a].status) && (chrome.scripting.executeScript({                target: {                  tabId: e,                  frameIds: [o]                },                func: d,                args: [t, i, a],                injectImmediately: !1

Navigation to a link inside the injected function

js/15.js
                }              }, () => {                "undefined" != typeof nowProcess11186163 && null !== nowProcess11186163 || (nowProcess11186163 = !0, a("executeScript_openLink_succes"), window.location.href = e)              })
Values handed to the injected script
  • word
    best laptop 2026

    The search keyword you entered, typed into the page input.

  • selectors
    { input: "#kw", button: "#su" } (server chosen)

    Server-supplied locators for the input and button to act on.

  • reg_string
    search.example.test/s?

    Server text that decides which tab addresses are targeted.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed 元器件库存及价格全网搜 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • files.xiaolvji.comwidely used

    元器件库存及价格全网搜 sends data to files.xiaolvji.com. A widely used service: 25 other extensions we have analysed send data here.

Updated 15 October 2026gllomimblbddnnmhgbdannbdifnhepjd