Is Shein选品助手 - 免费希音选品与数据分析 safe?
Shein选品助手 - 免费希音选品与数据分析 is critical risk. On start, the worker fetches config from api.sheinshuju.com and installs the returned rules unsigned. With all-URLs host access and declarativeNetRequest permissions, returned redirect rules can alter requests across sites you visit.…
Who publishes it极鲸云 - 8 other listings from the same operator, 2 of them carrying a finding
极鲸云 - 8 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
8 other listings published from this account, 144k+ users between them. 2 of them carry a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote config installs request-redirect rules
On start, the worker fetches config from api.sheinshuju.com and installs the returned rules unsigned.
With all-URLs host access and declarativeNetRequest permissions, returned redirect rules can alter requests across sites you visit.
What actually happens
The extension starts its background worker.
This happens as part of the extension's normal startup and configuration refresh path.
It asks a remote server for rules that can change matching web requests.
The returned rules are installed as browser request-handling rules with all-URLs host access.
Captured request
Remote configuration fields consumed by the service worker
- Request-handling rulesdata.rules
Lets the server define which page requests the extension changes after startup.
- Rule identifiersdata.ruleIds
Lets the extension remove and re-add the same server-provided rules during navigation.
- Refresh delaydata.delay
Controls how long the extension waits before re-adding selected rules after navigation.
- Redirect actionaction.type === "redirect"
Can change where a matching browser request goes instead of leaving it untouched.
The code that does this
Startup config is installed directly as dynamic request rules
var zt, Vt = [], Ut = [];Ht(Nt().m(function t() { var e, r, n, o; return Nt().w(function(t) { for (;;) switch (t.p = t.n) { case 0: return t.n = 1, chrome.declarativeNetRequest.getDynamicRules(); case 1: return e = t.v, t.p = 2, t.n = 3, fetch("".concat("https://api.sheinshuju.com", "/api/v1/plugin/config")); case 3: return r = t.v, kt = r.headers.get("anti-content"), t.n = 4, r.json(); case 4: n = t.v, Dt = n.data, Vt = n.data.rules, Ut = n.data.ruleIds, o = n.data.delay, zt = (0, i.debounce)($t, o), chrome.webNavigation.onCompleted.addListener(zt), chrome.webNavigation.onBeforeNavigate.addListener(Wt), chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: e.map(function(t) { return t.id }), addRules: n.data.rules }), chrome.storage.sync.set({ pluginConfig: n.data }), t.n = 6; break; case 5: t.p = 5, t.v, chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: e.filter(function(t) { return "redirect" === t.action.type }).map(function(t) { return t.id }) }); case 6: return t.a(2) } }, t, null, [ [2, 5] ])}))();var Wt = function() { var t = Ht(Nt().m(function t(e) { return Nt().w(function(t) { for (;;) switch (t.n) { case 0: if ("prerender" !== e.documentLifecycle) { t.n = 1; break } return t.a(2); case 1: return t.n = 2, n(10); case 2: chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: Ut }); case 3: return t.a(2) } }, t) })); return function(e) { return t.apply(this, arguments) }}();function $t() { return Kt.apply(this, arguments)}function Kt() { return (Kt = Ht(Nt().m(function t() { return Nt().w(function(t) { for (;;) switch (t.n) { case 0: chrome.declarativeNetRequest.updateDynamicRules({ addRules: Vt.filter(function(t) { return Ut.includes(t.id) }) }); case 1: return t.a(2) } }, t) }))).apply(this, arguments)}Manifest permissions that make the returned rules broad
- All-site host accesshost_permissions: ["<all_urls>"]
Lets the extension apply matching request rules across the sites you visit, not only on the vendor's site.
- Request rule permissiondeclarativeNetRequestWithHostAccess
Lets the extension install browser-level rules that alter matching network requests.
- Navigation observerwebNavigation
Lets the background worker react as pages navigate and re-apply selected rules.
Remote host involved in this rule path
- api.sheinshuju.com
Serves plugin configuration that the background service worker parses and installs as dynamic request-handling rules.
What it can do
Permissions this extension asks for, as declared in version 1.2.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Add items to the right-click menu
contextMenus
Read and change cookies, including the ones that keep you signed in
cookies
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab
See the address and title of every tab you have open
tabs
See every page you navigate to, as you navigate to it
webNavigation
Run its own code inside the pages you visit
scripting
Block and redirect the requests your browser makes
declarativeNetRequest
See which of your requests its blocking rules matched
declarativeNetRequestFeedback
Clear your browsing history, cache and cookies
browsingData