Is 三赞-抖音直播增强助手 safe?
The extension sends the full URL of every page you visit, plus a persistent user ID, to plug2025.bm-com.com.
A content script runs on all websites and, on each page load, reports the page's host and full URL to the extension's backend. The report includes a stored user ID, session ID and paid-user status. This applies to every site, although the extension's stated purpose only concerns Douyin live streams.
Who publishes itmikertan - 6 other listings from the same operator, 3 of them carrying a finding
mikertan - 6 other listings from the same operator, 3 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
6 other listings published from this account, 5k+ users between them. 3 of them carry a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Coupert sends a cleaned copy of the shopping page you are on to its AI endpoint
Code analysis shows Coupert builds an HTML snapshot of the open page and posts it to coupert.com/api/v2/ai/at-biz to locate coupon fields.
Sending depends on remote flags; this was not observed running.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open a shopping or checkout page on a site Coupert is enabled for.
Coupert copies the page HTML and posts it to its AI endpoint to find coupon fields.
Gated by remote flags ai_at, rule_check_ai and ai_coupon.
Snapshot is built and sent from the page
Background posts it to the AI endpoint
background.js function Oh() { let e = arguments.length > 0 && void 0 !== arguments[0] ? arguments[0] : {}; return Kn("/ai/at-biz", { method: "post", data: e, ignoreSignKeys: ["html", "code_input_html", "prompt"] }) })), u.ZP.bp().on("ai:get_ai_result", (async (e, t, n) => { try { const { content: n = {} } = e, { data: i = {} } = n, o = await async function(e) { return ut({ request: async () => await Oh(e) }) }(i); if (!(0, y.isEmpty)(o) && 0 === (null == o ? void 0 : o.code)) return void t(null == o ? void 0 : o.data); t(null) } catch (e) {- html<div class="cart"><input id="coupon" placeholder="Promo code">...</div>
A trimmed copy of the page you are viewing, including visible text and forms.
- promptFind the coupon input and apply button in this HTML
An instruction wrapped around the page HTML for the AI model.
- store_id48213
Identifies the shop you are on.
- www.coupert.com
Receives page HTML at /api/v2/ai/at-biz; a remote-config URL override can redirect it.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 2.1.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on douyin.com
*://*.douyin.com/*
Store data in your browser
storage
Show a panel beside the page
sidePanel
Start, monitor and manage your downloads
downloads
Where it sends data
Destinations our analysis observed 三赞-抖音直播增强助手 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- plug2025.bm-com.com
三赞-抖音直播增强助手 sends data to plug2025.bm-com.com. 11 other extensions we have analysed send data here.