Is Shein选品助手 - 免费希音选品与数据分析 safe?

High risk

Shein选品助手 - 免费希音选品与数据分析 is high risk. On start, the worker fetches config from api.sheinshuju.com and installs the returned rules unsigned. With all-URLs host access and declarativeNetRequest permissions, returned redirect rules can alter requests across sites you visit.…

极鲸云v1.2.4Chrome Web Store
69Risk
Who publishes it

极鲸云 - 8 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
极鲸云
Website
www.sheinshuju.com

Same store account

8 other listings published from this account, 134k+ users between them. 1 of them carries a finding.

Temu选品助手100k+LowShopee选品助手 - 免费虾皮选品与数据分析10k+MediumAliSold卖家助手 - 免费图搜同款、查侵权10k+High亚马逊选品助手 - 免费Amazon选品与数据分析8k+HighTiktok选品助手 - 免费Tiktok选品与数据分析2k+Medium速卖通选品助手 - 免费AliExpress选品与数据分析2k+Low2 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote config installs request-redirect rules

On start, the worker fetches config from api.sheinshuju.com and installs the returned rules unsigned.

With all-URLs host access and declarativeNetRequest permissions, returned redirect rules can alter requests across sites you visit.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

The extension starts its background worker.

This happens as part of the extension's normal startup and configuration refresh path.

The extension did this

It asks a remote server for rules that can change matching web requests.

The returned rules are installed as browser request-handling rules with all-URLs host access.

Captured request
GEThttps://api.sheinshuju.com/api/v1/plugin/config
Remote configuration fields consumed by the service worker
  • Request-handling rules
    data.rules

    Lets the server define which page requests the extension changes after startup.

  • Rule identifiers
    data.ruleIds

    Lets the extension remove and re-add the same server-provided rules during navigation.

  • Refresh delay
    data.delay

    Controls how long the extension waits before re-adding selected rules after navigation.

  • Redirect action
    action.type === "redirect"

    Can change where a matching browser request goes instead of leaving it untouched.

The code that does this

Startup config is installed directly as dynamic request rules

Readable version
var zt, Vt = [],  Ut = [];Ht(Nt().m(function t() {  var e, r, n, o;  return Nt().w(function(t) {    for (;;) switch (t.p = t.n) {      case 0:        return t.n = 1, chrome.declarativeNetRequest.getDynamicRules();      case 1:        return e = t.v, t.p = 2, t.n = 3, fetch("".concat("https://api.sheinshuju.com", "/api/v1/plugin/config"));      case 3:        return r = t.v, kt = r.headers.get("anti-content"), t.n = 4, r.json();      case 4:        n = t.v, Dt = n.data, Vt = n.data.rules, Ut = n.data.ruleIds, o = n.data.delay, zt = (0, i.debounce)($t, o), chrome.webNavigation.onCompleted.addListener(zt), chrome.webNavigation.onBeforeNavigate.addListener(Wt), chrome.declarativeNetRequest.updateDynamicRules({          removeRuleIds: e.map(function(t) {            return t.id          }),          addRules: n.data.rules        }), chrome.storage.sync.set({          pluginConfig: n.data        }), t.n = 6;        break;      case 5:        t.p = 5, t.v, chrome.declarativeNetRequest.updateDynamicRules({          removeRuleIds: e.filter(function(t) {            return "redirect" === t.action.type          }).map(function(t) {            return t.id          })        });      case 6:        return t.a(2)    }  }, t, null, [    [2, 5]  ])}))();var Wt = function() {  var t = Ht(Nt().m(function t(e) {    return Nt().w(function(t) {      for (;;) switch (t.n) {        case 0:          if ("prerender" !== e.documentLifecycle) {            t.n = 1;            break          }          return t.a(2);        case 1:          return t.n = 2, n(10);        case 2:          chrome.declarativeNetRequest.updateDynamicRules({            removeRuleIds: Ut          });        case 3:          return t.a(2)      }    }, t)  }));  return function(e) {    return t.apply(this, arguments)  }}();function $t() {  return Kt.apply(this, arguments)}function Kt() {  return (Kt = Ht(Nt().m(function t() {    return Nt().w(function(t) {      for (;;) switch (t.n) {        case 0:          chrome.declarativeNetRequest.updateDynamicRules({            addRules: Vt.filter(function(t) {              return Ut.includes(t.id)            })          });        case 1:          return t.a(2)      }    }, t)  }))).apply(this, arguments)}
Manifest permissions that make the returned rules broad
  • All-site host access
    host_permissions: ["<all_urls>"]

    Lets the extension apply matching request rules across the sites you visit, not only on the vendor's site.

  • Request rule permission
    declarativeNetRequestWithHostAccess

    Lets the extension install browser-level rules that alter matching network requests.

  • Navigation observer
    webNavigation

    Lets the background worker react as pages navigate and re-apply selected rules.

Remote host involved in this rule path
    • api.sheinshuju.com

    Serves plugin configuration that the background service worker parses and installs as dynamic request-handling rules.

Updated 30 September 2026ljccnonneanghhogfgkjookoghnbhiak