Is OZONBIGSELL - 专注OZON平台数据分析 - 国内开发OZON插件第一人 safe?

Medium risk

OZONBIGSELL modifies Ozon seller analytics pages to return Premium Plus access and synthetic analytics data.

On seller.ozon.ru analytics pages, the extension replaces page fetch and XMLHttpRequest behavior for premium status, graph, and statistics URLs. When enabled, it returns extension-generated JSON showing Premium Plus or full analytics access and random metric data instead of the site's normal responses.

ozonbigsellv1.4.2Chrome Web Store
45Risk
Who publishes it

ozonbigsell - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ozonbigsell

Same store account

1 other listing published from this account, 1k+ users between them, none of them carrying a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

OZONBIGSELL fabricates Ozon Premium access on the seller analytics page

On seller.ozon.ru's analytics page, the extension replaces window.fetch and XHR before the page's own code runs.

Matching requests get a fabricated PREMIUM_PLUS response, confirmed even while Ozon's real server answered 403.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open seller.ozon.ru/app/analytics while signed in as an Ozon seller.

The page's own JavaScript then asks Ozon's servers for your account's premium status.

The extension did this

The extension intercepts that request and returns fabricated data granting full paid PREMIUM_PLUS access.

This happens even when Ozon's real server rejects the same request with a 403.

Fields OZONBIGSELL fabricates for premium and analytics requests
  • Premium plan
    subscription.current: "PREMIUM_PLUS"

    Claims your seller account holds Ozon's paid PREMIUM_PLUS plan, whether or not it actually does.

  • Full analytics unlock
    features.analytics: "full", features.reports: "full"

    Marks every analytics, marketing, and reporting feature as fully unlocked.

  • Access flag
    hasAccess: true, accessLevel: "FULL"

    Sets an access flag so the page believes your account passed Ozon's own entitlement check.

  • Fabricated metrics
    dataPoints[0]: {id: "metric_0", value: 742, trend: "up"}

    Invents 15 random sales and traffic numbers to fill the analytics charts instead of real data.

  • Fake renewal date
    grace_period_end_at: "2026-10-08T12:00:00.000Z"

    Invents a 30-day-out grace-period expiry so the fake plan looks like a real active subscription.

The code that does this

The response-forging logic: shipped minified code vs. deobfuscated form

Readable version

URL matcher and fake-response builder

const SESSION_KEY_ENABLED = "ozonbigsell_seller_premium_enabled";// URL patterns that get a forged premium/analytics responseconst PREMIUM_URL_PATTERNS = [  /\/premium\/status/i,  /seller-analytics\/premium\/status/i,  /get-seller-premium-status/i,  /\/analytics\/graphs/i,  /\/graph\/data/i,  /\/statistics\/data/i,];const onAnalyticsPage = () =>  /^https:\/\/seller\.ozon\.ru\/app\/analytics(?:[/?#]|$)/i.test(location.href);const forgeryEnabled = () => sessionStorage.getItem(SESSION_KEY_ENABLED) !== "0";const shouldForge = (url) =>  forgeryEnabled() && onAnalyticsPage() && PREMIUM_URL_PATTERNS.some((p) => p.test(url));function buildFakePremiumResponse(url) {  const base = {    status: "grace_good",    is_premium: true,    isPremium: true,    isPremiumPlus: true,    isAnalyst: true,    subscription: {      current: "PREMIUM_PLUS",      available: ["PREMIUM_PLUS"],      grace_period_end_at: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),    },    features: {      analytics: "full", marketing: "full", api: "full_access",      graphs: "full", reports: "full", statistics: "full", recommendations: "full",    },  };  if (/\/analytics\/graphs/i.test(url) || /\/graph\/data/i.test(url)) {    return { ...base, graphsAccess: true, dataSets: ["sales", "traffic", "conversion"], timeRanges: ["day", "week", "month"] };  }  if (/seller-analytics\/premium\/status/i.test(url)) {    return {      ...base,      hasAccess: true,      accessLevel: "FULL",      dataPoints: Array.from({ length: 15 }, (_, i) => ({        id: `metric_${i}`,        value: Math.floor(Math.random() * 1000),        trend: Math.random() > 0.5 ? "up" : "down",        change: Math.floor(Math.random() * 100),      })),    };  }  return base;}

window.fetch override

function installFetchHook() {  const guardFlag = "__ozonbigsellFetchHook__";  if (window[guardFlag]) return;  window[guardFlag] = true;  const realFetch = window.fetch.bind(window);  window.fetch = async (input, init) => {    const url = input instanceof Request ? input.url : String(input ?? "");    if (shouldForge(url)) {      return new Response(JSON.stringify(buildFakePremiumResponse(url)), {        status: 200,        headers: { "Content-Type": "application/json" },      });    }    return realFetch(input, init);  };}

XMLHttpRequest override

(function installXhrHook() {  const proto = XMLHttpRequest.prototype;  const guardFlag = "__ozonbigsellXhrOpen__";  if (proto[guardFlag]) return;  const realOpen = proto.open;  const realSend = proto.send;  proto.open = function (method, url, async, user, password) {    this.__ozonUrl__ = String(url);    return realOpen.call(this, method, url, async ?? true, user, password);  };  proto.send = function (body) {    const url = this.__ozonUrl__ ?? "";    if (shouldForge(url)) {      const fakeBody = JSON.stringify(buildFakePremiumResponse(url));      Object.defineProperties(this, {        responseText: { value: fakeBody },        response: { value: fakeBody },        status: { value: 200 },        statusText: { value: "OK" },        readyState: { value: 4 },      });      queueMicrotask(() => {        this.onreadystatechange?.call(this, new Event("readystatechange"));        this.onload?.call(this, new Event("load"));      });      return;    }    return realSend.call(this, body);  };  proto[guardFlag] = true;  proto.__ozonbigsellXhrSend__ = true;})();
Page DOM modified

A draggable panel with an on/off toggle is added to the page, defaulted to on, which is what enables the forged premium responses.

Target
The floating panel on seller.ozon.ru/app/analytics
Before
(no panel present; the unmodified Ozon analytics dashboard)
After the extension changed it
<div id="ozonbigsell_seller_premium_panel">  <div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:12px;">    <span style="font-weight:500;color:#1D2129;">Insight</span>    <span style="font-weight:bold;color:#1677FF;font-size:14px;">OZONBIGSELL</span>  </div>  <div id="ozonbigsell_premium_toggle" style="width:40px;height:20px;border-radius:10px;margin:0 auto 12px;cursor:pointer;background:#1677FF;position:relative;"></div>  <div style="text-align:center;font-weight:bold;padding:8px;border-radius:6px;background:#F7F8FA;color:#1D2129;">    Analytics access simulation: on  </div></div>
Check if you're affected

Console script that checks whether the current page's premium-status fetch is being forged.

Requires
  • Chrome DevTools
  • OZONBIGSELL extension installed and enabled
detect-ozon-premium-forgery.js · js
(async () => {  const probeUrl = "/api/seller-analytics/premium/status?__probe=" + Date.now();  const res = await fetch(probeUrl);  const body = await res.json().catch(() => null);  const forged = !!body && (body.isPremiumPlus === true || body?.subscription?.current === "PREMIUM_PLUS");  console.log(forged    ? "Forged premium response detected: " + JSON.stringify(body)    : "No forgery detected for this request.");  console.log(    "Toggle flag ozonbigsell_seller_premium_enabled =",    sessionStorage.getItem("ozonbigsell_seller_premium_enabled")  );})();
How to run it
  1. 1Open seller.ozon.ru/app/analytics with the extension installed.
  2. 2Open DevTools Console.
  3. 3Paste this script and press Enter.
  4. 4Read the printed result.
Updated 30 September 2026jnffopdghacfibgkllcbgfnldclpnbbb