Is Shein Images Downloader safe?

Medium risk

Shein Images Downloader sends signed-in account profile and subscription details to Mixpanel analytics.

When the popup opens, it initializes Mixpanel and tracks a page view. After reading the Supabase session, it identifies the user and sends the Google account name, email address, Supabase user id, and Pro or Free subscription plan to Mixpanel endpoints.

Alexv2.3.3Chrome Web Store
45Risk
Who publishes it

Alex - 5 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Alex

Same store account

5 other listings published from this account, 17k+ users between them, none of them carrying a finding.

IGEmail - IG Email Extractor5k+LowTemu Images Downloader5k+LowComment Export Tool3k+CleanTwitter Followers Exporter2k+CleanTwitter AutoFollow Pro2k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Popup sends signed-in account profile details to Mixpanel analytics.

When you open the popup, it reads signed-in account details from the Supabase session: Google account name, email, Supabase user id, and plan.

Those details go to Mixpanel at api-js.mixpanel.com/engage/ for analytics profile updates.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

The user opens the extension popup.

The extension did this

The popup reads signed-in account fields and sends Mixpanel profile updates with name, email, user id, and plan.

Captured request
POSTapi-js.mixpanel.com/engage/
Fields in the request
  • Stored account profile data
    Alex User, alex@example.com, Supabase user id, Free plan (illustrative)

    This links analytics profile updates to a signed-in account identity and subscription state.

What it can do

Permissions this extension asks for, as declared in version 2.3.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on shein.com

    *://*.shein.com/*

  • Read and change your data on shein.com.vn

    *://*.shein.com.vn/*

  • Read and change your data on shein.com.hk

    *://*.shein.com.hk/*

  • Read and change your data on shein.com.mx

    *://*.shein.com.mx/*

  • Read and change your data on shein.co

    *://*.shein.co/*

  • Read and change your data on shein.co.uk

    *://*.shein.co.uk/*

  • Read and change your data on shein.cn

    *://*.shein.cn/*

  • Read and change your data on shein.in

    *://*.shein.in/*

  • Read and change your data on shein.tw

    *://*.shein.tw/*

  • Read and change your data on shein.se

    *://*.shein.se/*

  • Read and change your data on img.ltwebstatic.com

    *://*.img.ltwebstatic.com/*

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Shein Images Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api-js.mixpanel.comwidely used

    Shein Images Downloader sends data to api-js.mixpanel.com. A widely used service: 47 other extensions we have analysed send data here.

Updated 30 September 2026hamgafmfcmaipelffjbdgikejedlnbmm