Is 稀土掘金 safe?

Medium risk

稀土掘金 is medium risk. Submitting a query in the global search overlay records an event with the full query text, sent to ByteDance's endpoint mcs.zijieapi.com/list. The content script runs on all URLs, so this can fire outside juejin.cn when global search is on.

juejin-browser-extensionv1.0.3Chrome Web Store
49Risk
Who publishes it

juejin-browser-extension - no other listings under this identity, 2 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
juejin-browser-extension
Website
juejin.cn/topic/6824710202692993037?sort=newest

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

ip.cn
Also called by 3 other listings, including JSON格式化工具
lf-web-assets.juejin.cn
Also called by 4 other listings, including COSE - 多平台文章同步

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Search overlay sends queries to analytics

Submitting a query in the global search overlay records an event with the full query text, sent to ByteDance's endpoint mcs.zijieapi.com/list.

The content script runs on all URLs, so this can fire outside juejin.cn when global search is on.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You submit text through the extension's global search overlay.

The extension did this

The extension records an analytics event that includes the full query text.

Fields added to the search analytics event
  • Your search query
    browser extension review

    This is the full text you typed into the extension's search overlay.

  • Selected search engine
    google

    This records which search destination the overlay used for your query.

  • Suggestion selection
    0

    This distinguishes a typed submission from a suggestion you selected.

Captured request
POSThttps://mcs.zijieapi.com/list
Headers
Content-Type
application/json; charset=utf-8
Why you can't catch this in DevTools

The analytics collection host is stored in the bundle as an encoded string and decoded before events are sent.

Decoded value
https://mcs.zijieapi.com/list
The code that does this

The overlay submit path and analytics sender

Readable version

Global search submit handler in readable form

static/inject.js
function a(t) {  var n, i, a;  const s = t || (null == (n = e.value) ? void 0 : n.keyword);  s && (r.event("search_submit", {    search_keyword: s,    engine: null == (i = o.value) ? void 0 : i.name,    is_suggest: Boolean(t) ? 1 : 0  }), null == (a = chrome.search) || a.query({    disposition: "NEW_TAB",    text: s  }), l())}

Analytics event URL construction in readable form

static/inject.js
e.prototype.getUrl = function(e) {  var t = "";  switch (e) {    case "event":      t = "/list";      break;    case "webid":      t = "/webid";      break;    case "tobid":      t = "/tobid"  }  var o = "";  return this.initConfig.caller && (o = "?sdk_version=5.2.7&sdk_name=web&app_id=" + this.initConfig.app_id + "&caller=" + this.initConfig.caller), "" + this.getDomain() + t + o}

Analytics POST sender in readable form

static/inject.js
e.prototype.useFetch = function(e) {  var t = e.url,    o = e.data,    n = e.method,    r = e.success,    i = e.fail,    a = {      "Content-Type": "application/json; charset=utf-8"    };  if (Object.keys(this.customHeader).length)    for (var s in this.customHeader) a[s] = this.customHeader[s];  window.fetch ? fetch(t, {    method: n || "POST",    headers: a,    body: JSON.stringify(o)  }).then((function(e) {    return e.json()  })).then((function(e) {    r && r(e)  })).catch((function(e) {    i && i(o, e)  })) : (this.requestType = "xhr", console.log("your brwoser not support fetch, use xhr"), this.useRequest({    url: t,    data: o,    method: n,    success: r,    fail: i  }))}
The code that does this

The extension installs this content script on every URL

Readable version

Manifest content-script scope

manifest.json
"content_scripts": [  {    "matches": ["<all_urls>"],    "js": ["static/inject.js"]  }]
External analytics destination
    • mcs.zijieapi.com

    ByteDance MCS analytics endpoint that receives the search analytics event.

What it can do

Permissions this extension asks for, as declared in version 1.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    *://*/*

  • Store data in your browser

    storage

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Add items to the right-click menu

    contextMenus

  • See the address and title of every tab you have open

    tabs

  • Run searches with your default search engine

    search

Updated 30 September 2026lecdifefmmfjnjjinhaennhdlmcaeeeb