Is K dropshipping pro safe?
K dropshipping pro sends the full HTML of pages matching a server-supplied list to its vendor backend.
The extension downloads a list of site patterns from the vendor's server and, when a page you visit matches one, reads the page's full HTML once it has loaded. It then posts that HTML with the page URL to the vendor's product-parsing API. Which sites are captured is set by the server list rather than the extension's manifest.
Who publishes itZQ Technology Co., Ltd - 2 other listings from the same operator, 1 of them carrying a finding
ZQ Technology Co., Ltd - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 1k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
K dropshipping pro sends full page HTML to its server on sites the server names
Code analysis shows the extension fetches a server list of URL patterns and, on a matching page, sends the full page HTML to system.k-dropshipping.com.
The list is set server-side, not in the manifest.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open a page whose address matches a pattern in the server-supplied site list.
The extension reads the whole page HTML and posts it, with the page address, to the vendor backend.
Server list fetch and URL pattern match
Only entries enabled on the server are kept; each carries its own regex.
const list = (await api.get('/v2/platform/parser/list')).data.filter(p => p.enabled)First entry whose regex matches hostname plus path is selected.
for (const p of list) if (new RegExp(p.urlPattern, 'i').test(hostname + pathname)) return pFull document HTML read and POST
Wait for the selector and page load, then take the whole document.
await waitForSelector(sel); await pageLoaded(); await sleep(1500); return (await platformSpecific(platform)) || document.documentElement.outerHTMLUpload to the vendor API (https://system.k-dropshipping.com/api).
api.post('/v2/platform/product/parse', {platform, productUrl, htmlContent})- platformgmarket
Which shop entry from the server list matched the page.
- productUrlhttps://item.gmarket.co.kr/Item?goodscode=3456789012 (illustrative)
The address of the page you were viewing.
- htmlContent<html lang="ko">...full document...</html> (illustrative)
The full HTML of that page as loaded in your browser.
- system.k-dropshipping.com
Serves the site list and receives page HTML; same vendor family as system.zqdropshipping.com.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed K dropshipping pro contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- system.k-dropshipping.com
K dropshipping pro sends data to system.k-dropshipping.com. No other extension we have analysed sends data here.