Is PPSPY-#1 Shopify analytics & dropship tool safe?
PPSPY is medium risk. Any page on ppspy.com or shenbihuyu.com can send a 'shopMeta' message via externally_connectable, making PPSPY fetch any URL's /meta.json and return it. ppspy.com is expected; shenbihuyu.com is undisclosed. DA triggered it six times.
Who publishes ithttps://www.pipiads.com - no other listings under this identity
https://www.pipiads.com - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Undisclosed domain can use extension as fetch proxy via externally_connectable
Any page on ppspy.com or shenbihuyu.com can send a 'shopMeta' message via externally_connectable, making PPSPY fetch any URL's /meta.json and return it. ppspy.com is expected; shenbihuyu.com is undisclosed.
DA triggered it six times.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-940
- Source
- Dynamic sandbox
A page on ppspy.com or shenbihuyu.com calls chrome.runtime.sendMessage with {function: 'shopMeta', url: '<any Shopify URL>'}.
Both domains are listed in the manifest's externally_connectable.matches, so Chrome delivers the message to the background service worker without any user interaction.
The extension fetches https://{domain}/meta.json on behalf of the caller and returns the parsed store metadata.
The background script constructs the fetch URL from the caller-supplied value. No additional validation beyond basic domain-regex parsing is applied before the request is issued.
externally_connectable handler and shopMeta fetch (background.js:20437-20479)
chrome.runtime.onMessageExternal.addListener(((message, _sender, sendResponse) => { handleMessageExternal(message).then(sendResponse).catch((() => ""));}));async function handleMessageExternal(message) { let result; switch (message.function) { case "shopMeta": result = await shopMeta(message.url).catch((() => "")); break; default: break; } return result;}async function shopMeta(url) { let errorMessage; const match = /^(?:http(s)?\/\/)?([^/]+\.[^/]+)/i.exec(url.trim()); if (!match) { errorMessage = "Parse domain failure."; return { errorMessage }; } const meta = await request({ url: `https://${match[2]}/meta.json` }).catch((error => { errorMessage = error.response && error.response.status === 404 ? "This site is not a shopify site, you can only submit shopify sites." : "This store cannot be opened now, please change a shopify store to track."; })); if (typeof meta === "object") { if (meta.domain === undefined || meta.published_products_count === undefined) { errorMessage = "This site is not a shopify site, you can only submit shopify sites."; } else if (meta.published_products_count > 15e3) { errorMessage = "The number of store items cannot be greater than 15000, please change to another store to track."; } } else { errorMessage = "This site is not a shopify site, you can only submit shopify sites."; } return { meta: errorMessage ? undefined : meta, errorMessage };}- ppspy.com
PPSPY's own web application, the primary use case for the shopMeta relay (expected for the extension's core function).
- shenbihuyu.com
Second domain listed in externally_connectable. Not mentioned in the Chrome Web Store listing, privacy policy, or extension UI. Relationship to PPSPY is not disclosed.
Demonstrates sending a shopMeta message from an allowed origin (ppspy.com) to the PPSPY extension and receiving the fetched Shopify metadata. Must be run from a page on ppspy.com with the extension installed.
- Chrome with PPSPY extension (lppbajkahdbbadheilijoeegnfndhlab) installed
- Page context on ppspy.com or shenbihuyu.com
// Run this in the browser console on any ppspy.com page// Replace EXT_ID with the actual PPSPY extension IDconst EXT_ID = 'lppbajkahdbbadheilijoeegnfndhlab';chrome.runtime.sendMessage( EXT_ID, { function: 'shopMeta', url: 'https://allbirds.myshopify.com' }, (response) => { if (response && response.meta) { console.log('Store metadata returned by extension:', response.meta); // response.meta includes: domain, published_products_count, etc. } else { console.log('Response:', response); } });- 1Install the PPSPY extension.
- 2Navigate to any page on ppspy.com.
- 3Open DevTools console and paste this script.
- 4Observe that the extension fetches allbirds.myshopify.com/meta.json and returns the metadata to your page.
What it can do
Permissions this extension asks for, as declared in version 1.6.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage