Is PPSPY-#1 Shopify analytics & dropship tool safe?

Medium risk

PPSPY is medium risk. Any page on ppspy.com or shenbihuyu.com can send a 'shopMeta' message via externally_connectable, making PPSPY fetch any URL's /meta.json and return it. ppspy.com is expected; shenbihuyu.com is undisclosed. DA triggered it six times.

https://www.pipiads.comv1.6.7Chrome Web Store
45Risk
Who publishes it

https://www.pipiads.com - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
https://www.pipiads.com

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Undisclosed domain can use extension as fetch proxy via externally_connectable

Any page on ppspy.com or shenbihuyu.com can send a 'shopMeta' message via externally_connectable, making PPSPY fetch any URL's /meta.json and return it. ppspy.com is expected; shenbihuyu.com is undisclosed.

DA triggered it six times.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-940
Source
Dynamic sandbox
What actually happens
You did this

A page on ppspy.com or shenbihuyu.com calls chrome.runtime.sendMessage with {function: 'shopMeta', url: '<any Shopify URL>'}.

Both domains are listed in the manifest's externally_connectable.matches, so Chrome delivers the message to the background service worker without any user interaction.

The extension did this

The extension fetches https://{domain}/meta.json on behalf of the caller and returns the parsed store metadata.

The background script constructs the fetch URL from the caller-supplied value. No additional validation beyond basic domain-regex parsing is applied before the request is issued.

The code that does this

externally_connectable handler and shopMeta fetch (background.js:20437-20479)

Readable version
chrome.runtime.onMessageExternal.addListener(((message, _sender, sendResponse) => {    handleMessageExternal(message).then(sendResponse).catch((() => ""));}));async function handleMessageExternal(message) {    let result;    switch (message.function) {      case "shopMeta":        result = await shopMeta(message.url).catch((() => ""));        break;      default:        break;    }    return result;}async function shopMeta(url) {    let errorMessage;    const match = /^(?:http(s)?\/\/)?([^/]+\.[^/]+)/i.exec(url.trim());    if (!match) {        errorMessage = "Parse domain failure.";        return { errorMessage };    }    const meta = await request({        url: `https://${match[2]}/meta.json`    }).catch((error => {        errorMessage = error.response && error.response.status === 404            ? "This site is not a shopify site, you can only submit shopify sites."            : "This store cannot be opened now, please change a shopify store to track.";    }));    if (typeof meta === "object") {        if (meta.domain === undefined || meta.published_products_count === undefined) {            errorMessage = "This site is not a shopify site, you can only submit shopify sites.";        } else if (meta.published_products_count > 15e3) {            errorMessage = "The number of store items cannot be greater than 15000, please change to another store to track.";        }    } else {        errorMessage = "This site is not a shopify site, you can only submit shopify sites.";    }    return { meta: errorMessage ? undefined : meta, errorMessage };}
Domains granted externally_connectable access in manifest
    • ppspy.com

    PPSPY's own web application, the primary use case for the shopMeta relay (expected for the extension's core function).

    • shenbihuyu.com

    Second domain listed in externally_connectable. Not mentioned in the Chrome Web Store listing, privacy policy, or extension UI. Relationship to PPSPY is not disclosed.

Reproduce it yourself

Demonstrates sending a shopMeta message from an allowed origin (ppspy.com) to the PPSPY extension and receiving the fetched Shopify metadata. Must be run from a page on ppspy.com with the extension installed.

Requires
  • Chrome with PPSPY extension (lppbajkahdbbadheilijoeegnfndhlab) installed
  • Page context on ppspy.com or shenbihuyu.com
trigger_shopmeta.js · js
// Run this in the browser console on any ppspy.com page// Replace EXT_ID with the actual PPSPY extension IDconst EXT_ID = 'lppbajkahdbbadheilijoeegnfndhlab';chrome.runtime.sendMessage(  EXT_ID,  { function: 'shopMeta', url: 'https://allbirds.myshopify.com' },  (response) => {    if (response && response.meta) {      console.log('Store metadata returned by extension:', response.meta);      // response.meta includes: domain, published_products_count, etc.    } else {      console.log('Response:', response);    }  });
How to run it
  1. 1Install the PPSPY extension.
  2. 2Navigate to any page on ppspy.com.
  3. 3Open DevTools console and paste this script.
  4. 4Observe that the extension fetches allbirds.myshopify.com/meta.json and returns the metadata to your page.

What it can do

Permissions this extension asks for, as declared in version 1.6.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

Updated 30 September 2026lppbajkahdbbadheilijoeegnfndhlab