Is OZONBIGSELL - 专注OZON平台数据分析 - 国内开发OZON插件第一人 safe?
OZONBIGSELL modifies Ozon seller analytics pages to return Premium Plus access and synthetic analytics data.
On seller.ozon.ru analytics pages, the extension replaces page fetch and XMLHttpRequest behavior for premium status, graph, and statistics URLs. When enabled, it returns extension-generated JSON showing Premium Plus or full analytics access and random metric data instead of the site's normal responses.
Who publishes itozonbigsell - 1 other listing from the same operator, none carrying a finding
ozonbigsell - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 1k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
OZONBIGSELL fabricates Ozon Premium access on the seller analytics page
On seller.ozon.ru's analytics page, the extension replaces window.fetch and XHR before the page's own code runs.
Matching requests get a fabricated PREMIUM_PLUS response, confirmed even while Ozon's real server answered 403.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-506
- Source
- Dynamic sandbox
You open seller.ozon.ru/app/analytics while signed in as an Ozon seller.
The page's own JavaScript then asks Ozon's servers for your account's premium status.
The extension intercepts that request and returns fabricated data granting full paid PREMIUM_PLUS access.
This happens even when Ozon's real server rejects the same request with a 403.
- Premium plansubscription.current: "PREMIUM_PLUS"
Claims your seller account holds Ozon's paid PREMIUM_PLUS plan, whether or not it actually does.
- Full analytics unlockfeatures.analytics: "full", features.reports: "full"
Marks every analytics, marketing, and reporting feature as fully unlocked.
- Access flaghasAccess: true, accessLevel: "FULL"
Sets an access flag so the page believes your account passed Ozon's own entitlement check.
- Fabricated metricsdataPoints[0]: {id: "metric_0", value: 742, trend: "up"}
Invents 15 random sales and traffic numbers to fill the analytics charts instead of real data.
- Fake renewal dategrace_period_end_at: "2026-10-08T12:00:00.000Z"
Invents a 30-day-out grace-period expiry so the fake plan looks like a real active subscription.
The response-forging logic: shipped minified code vs. deobfuscated form
URL matcher and fake-response builder
const SESSION_KEY_ENABLED = "ozonbigsell_seller_premium_enabled";// URL patterns that get a forged premium/analytics responseconst PREMIUM_URL_PATTERNS = [ /\/premium\/status/i, /seller-analytics\/premium\/status/i, /get-seller-premium-status/i, /\/analytics\/graphs/i, /\/graph\/data/i, /\/statistics\/data/i,];const onAnalyticsPage = () => /^https:\/\/seller\.ozon\.ru\/app\/analytics(?:[/?#]|$)/i.test(location.href);const forgeryEnabled = () => sessionStorage.getItem(SESSION_KEY_ENABLED) !== "0";const shouldForge = (url) => forgeryEnabled() && onAnalyticsPage() && PREMIUM_URL_PATTERNS.some((p) => p.test(url));function buildFakePremiumResponse(url) { const base = { status: "grace_good", is_premium: true, isPremium: true, isPremiumPlus: true, isAnalyst: true, subscription: { current: "PREMIUM_PLUS", available: ["PREMIUM_PLUS"], grace_period_end_at: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(), }, features: { analytics: "full", marketing: "full", api: "full_access", graphs: "full", reports: "full", statistics: "full", recommendations: "full", }, }; if (/\/analytics\/graphs/i.test(url) || /\/graph\/data/i.test(url)) { return { ...base, graphsAccess: true, dataSets: ["sales", "traffic", "conversion"], timeRanges: ["day", "week", "month"] }; } if (/seller-analytics\/premium\/status/i.test(url)) { return { ...base, hasAccess: true, accessLevel: "FULL", dataPoints: Array.from({ length: 15 }, (_, i) => ({ id: `metric_${i}`, value: Math.floor(Math.random() * 1000), trend: Math.random() > 0.5 ? "up" : "down", change: Math.floor(Math.random() * 100), })), }; } return base;}window.fetch override
function installFetchHook() { const guardFlag = "__ozonbigsellFetchHook__"; if (window[guardFlag]) return; window[guardFlag] = true; const realFetch = window.fetch.bind(window); window.fetch = async (input, init) => { const url = input instanceof Request ? input.url : String(input ?? ""); if (shouldForge(url)) { return new Response(JSON.stringify(buildFakePremiumResponse(url)), { status: 200, headers: { "Content-Type": "application/json" }, }); } return realFetch(input, init); };}XMLHttpRequest override
(function installXhrHook() { const proto = XMLHttpRequest.prototype; const guardFlag = "__ozonbigsellXhrOpen__"; if (proto[guardFlag]) return; const realOpen = proto.open; const realSend = proto.send; proto.open = function (method, url, async, user, password) { this.__ozonUrl__ = String(url); return realOpen.call(this, method, url, async ?? true, user, password); }; proto.send = function (body) { const url = this.__ozonUrl__ ?? ""; if (shouldForge(url)) { const fakeBody = JSON.stringify(buildFakePremiumResponse(url)); Object.defineProperties(this, { responseText: { value: fakeBody }, response: { value: fakeBody }, status: { value: 200 }, statusText: { value: "OK" }, readyState: { value: 4 }, }); queueMicrotask(() => { this.onreadystatechange?.call(this, new Event("readystatechange")); this.onload?.call(this, new Event("load")); }); return; } return realSend.call(this, body); }; proto[guardFlag] = true; proto.__ozonbigsellXhrSend__ = true;})();A draggable panel with an on/off toggle is added to the page, defaulted to on, which is what enables the forged premium responses.
- Target
- The floating panel on seller.ozon.ru/app/analytics
(no panel present; the unmodified Ozon analytics dashboard)<div id="ozonbigsell_seller_premium_panel"> <div style="display:flex;align-items:center;justify-content:space-between;margin-bottom:12px;"> <span style="font-weight:500;color:#1D2129;">Insight</span> <span style="font-weight:bold;color:#1677FF;font-size:14px;">OZONBIGSELL</span> </div> <div id="ozonbigsell_premium_toggle" style="width:40px;height:20px;border-radius:10px;margin:0 auto 12px;cursor:pointer;background:#1677FF;position:relative;"></div> <div style="text-align:center;font-weight:bold;padding:8px;border-radius:6px;background:#F7F8FA;color:#1D2129;"> Analytics access simulation: on </div></div>Console script that checks whether the current page's premium-status fetch is being forged.
- Chrome DevTools
- OZONBIGSELL extension installed and enabled
(async () => { const probeUrl = "/api/seller-analytics/premium/status?__probe=" + Date.now(); const res = await fetch(probeUrl); const body = await res.json().catch(() => null); const forged = !!body && (body.isPremiumPlus === true || body?.subscription?.current === "PREMIUM_PLUS"); console.log(forged ? "Forged premium response detected: " + JSON.stringify(body) : "No forgery detected for this request."); console.log( "Toggle flag ozonbigsell_seller_premium_enabled =", sessionStorage.getItem("ozonbigsell_seller_premium_enabled") );})();- 1Open seller.ozon.ru/app/analytics with the extension installed.
- 2Open DevTools Console.
- 3Paste this script and press Enter.
- 4Read the printed result.