Is Shein选品助手 - 免费希音选品与数据分析 safe?

High risk

Shein选品助手 - 免费希音选品与数据分析 is high risk. On start, the worker fetches config from api.sheinshuju.com and installs the returned rules unsigned. With all-URLs host access and declarativeNetRequest permissions, returned redirect rules can alter requests across sites you visit.…

极鲸云v1.2.3Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassUNWANTED
TypeUnexpected
CWECWE-829
SourceAI SANDBOX

Remote config installs request-redirect rules

On start, the worker fetches config from api.sheinshuju.com and installs the returned rules unsigned.

With all-URLs host access and declarativeNetRequest permissions, returned redirect rules can alter requests across sites you visit.

01EvidenceCAUSE EFFECT
What actually happens
You did this

The extension starts its background worker.

This happens as part of the extension's normal startup and configuration refresh path.

The extension did this

It asks a remote server for rules that can change matching web requests.

The returned rules are installed as browser request-handling rules with all-URLs host access.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://api.sheinshuju.com/api/v1/plugin/config
03EvidenceFIELD TABLE
Remote configuration fields consumed by the service worker
FieldValueWhy it matters
Request-handling rules
data.rulesLets the server define which page requests the extension changes after startup.
Rule identifiers
data.ruleIdsLets the extension remove and re-add the same server-provided rules during navigation.
Refresh delay
data.delayControls how long the extension waits before re-adding selected rules after navigation.
Redirect action
action.type === "redirect"Can change where a matching browser request goes instead of leaving it untouched.
04EvidenceCODE COMPARE
The code that does this

Startup config is installed directly as dynamic request rules

What it actually does
var zt, Vt = [],
  Ut = [];
Ht(Nt().m(function t() {
  var e, r, n, o;
  return Nt().w(function(t) {
    for (;;) switch (t.p = t.n) {
      case 0:
        return t.n = 1, chrome.declarativeNetRequest.getDynamicRules();
      case 1:
        return e = t.v, t.p = 2, t.n = 3, fetch("".concat("https://api.sheinshuju.com", "/api/v1/plugin/config"));
      case 3:
        return r = t.v, kt = r.headers.get("anti-content"), t.n = 4, r.json();
      case 4:
        n = t.v, Dt = n.data, Vt = n.data.rules, Ut = n.data.ruleIds, o = n.data.delay, zt = (0, i.debounce)($t, o), chrome.webNavigation.onCompleted.addListener(zt), chrome.webNavigation.onBeforeNavigate.addListener(Wt), chrome.declarativeNetRequest.updateDynamicRules({
          removeRuleIds: e.map(function(t) {
            return t.id
          }),
          addRules: n.data.rules
        }), chrome.storage.sync.set({
          pluginConfig: n.data
        }), t.n = 6;
        break;
      case 5:
        t.p = 5, t.v, chrome.declarativeNetRequest.updateDynamicRules({
          removeRuleIds: e.filter(function(t) {
            return "redirect" === t.action.type
          }).map(function(t) {
            return t.id
          })
        });
      case 6:
        return t.a(2)
    }
  }, t, null, [
    [2, 5]
  ])
}))();
var Wt = function() {
  var t = Ht(Nt().m(function t(e) {
    return Nt().w(function(t) {
      for (;;) switch (t.n) {
        case 0:
          if ("prerender" !== e.documentLifecycle) {
            t.n = 1;
            break
          }
          return t.a(2);
        case 1:
          return t.n = 2, n(10);
        case 2:
          chrome.declarativeNetRequest.updateDynamicRules({
            removeRuleIds: Ut
          });
        case 3:
          return t.a(2)
      }
    }, t)
  }));
  return function(e) {
    return t.apply(this, arguments)
  }
}();

function $t() {
  return Kt.apply(this, arguments)
}

function Kt() {
  return (Kt = Ht(Nt().m(function t() {
    return Nt().w(function(t) {
      for (;;) switch (t.n) {
        case 0:
          chrome.declarativeNetRequest.updateDynamicRules({
            addRules: Vt.filter(function(t) {
              return Ut.includes(t.id)
            })
          });
        case 1:
          return t.a(2)
      }
    }, t)
  }))).apply(this, arguments)
}
05EvidenceFIELD TABLE
Manifest permissions that make the returned rules broad
FieldValueWhy it matters
All-site host access
host_permissions: ["<all_urls>"]Lets the extension apply matching request rules across the sites you visit, not only on the vendor's site.
Request rule permission
declarativeNetRequestWithHostAccessLets the extension install browser-level rules that alter matching network requests.
Navigation observer
webNavigationLets the background worker react as pages navigate and re-apply selected rules.
06EvidenceTHIRD PARTY LIST
Remote host involved in this rule path
  • api.sheinshuju.com

    Serves plugin configuration that the background service worker parses and installs as dynamic request-handling rules.

Updated 17 September 2026ljccnonneanghhogfgkjookoghnbhiak