Is Shein选品助手 - 免费希音选品与数据分析 safe?
Shein选品助手 - 免费希音选品与数据分析 is high risk. On start, the worker fetches config from api.sheinshuju.com and installs the returned rules unsigned. With all-URLs host access and declarativeNetRequest permissions, returned redirect rules can alter requests across sites you visit.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote config installs request-redirect rules
On start, the worker fetches config from api.sheinshuju.com and installs the returned rules unsigned.
With all-URLs host access and declarativeNetRequest permissions, returned redirect rules can alter requests across sites you visit.
The extension starts its background worker.
This happens as part of the extension's normal startup and configuration refresh path.
It asks a remote server for rules that can change matching web requests.
The returned rules are installed as browser request-handling rules with all-URLs host access.
| Field | Value | Why it matters | |
|---|---|---|---|
Request-handling rules | data.rules | Lets the server define which page requests the extension changes after startup. | |
Rule identifiers | data.ruleIds | Lets the extension remove and re-add the same server-provided rules during navigation. | |
Refresh delay | data.delay | Controls how long the extension waits before re-adding selected rules after navigation. | |
Redirect action | action.type === "redirect" | Can change where a matching browser request goes instead of leaving it untouched. |
Startup config is installed directly as dynamic request rules
var zt, Vt = [],
Ut = [];
Ht(Nt().m(function t() {
var e, r, n, o;
return Nt().w(function(t) {
for (;;) switch (t.p = t.n) {
case 0:
return t.n = 1, chrome.declarativeNetRequest.getDynamicRules();
case 1:
return e = t.v, t.p = 2, t.n = 3, fetch("".concat("https://api.sheinshuju.com", "/api/v1/plugin/config"));
case 3:
return r = t.v, kt = r.headers.get("anti-content"), t.n = 4, r.json();
case 4:
n = t.v, Dt = n.data, Vt = n.data.rules, Ut = n.data.ruleIds, o = n.data.delay, zt = (0, i.debounce)($t, o), chrome.webNavigation.onCompleted.addListener(zt), chrome.webNavigation.onBeforeNavigate.addListener(Wt), chrome.declarativeNetRequest.updateDynamicRules({
removeRuleIds: e.map(function(t) {
return t.id
}),
addRules: n.data.rules
}), chrome.storage.sync.set({
pluginConfig: n.data
}), t.n = 6;
break;
case 5:
t.p = 5, t.v, chrome.declarativeNetRequest.updateDynamicRules({
removeRuleIds: e.filter(function(t) {
return "redirect" === t.action.type
}).map(function(t) {
return t.id
})
});
case 6:
return t.a(2)
}
}, t, null, [
[2, 5]
])
}))();
var Wt = function() {
var t = Ht(Nt().m(function t(e) {
return Nt().w(function(t) {
for (;;) switch (t.n) {
case 0:
if ("prerender" !== e.documentLifecycle) {
t.n = 1;
break
}
return t.a(2);
case 1:
return t.n = 2, n(10);
case 2:
chrome.declarativeNetRequest.updateDynamicRules({
removeRuleIds: Ut
});
case 3:
return t.a(2)
}
}, t)
}));
return function(e) {
return t.apply(this, arguments)
}
}();
function $t() {
return Kt.apply(this, arguments)
}
function Kt() {
return (Kt = Ht(Nt().m(function t() {
return Nt().w(function(t) {
for (;;) switch (t.n) {
case 0:
chrome.declarativeNetRequest.updateDynamicRules({
addRules: Vt.filter(function(t) {
return Ut.includes(t.id)
})
});
case 1:
return t.a(2)
}
}, t)
}))).apply(this, arguments)
}| Field | Value | Why it matters | |
|---|---|---|---|
All-site host access | host_permissions: ["<all_urls>"] | Lets the extension apply matching request rules across the sites you visit, not only on the vendor's site. | |
Request rule permission | declarativeNetRequestWithHostAccess | Lets the extension install browser-level rules that alter matching network requests. | |
Navigation observer | webNavigation | Lets the background worker react as pages navigate and re-apply selected rules. |
- api.sheinshuju.com
Serves plugin configuration that the background service worker parses and installs as dynamic request-handling rules.