Is Simple Allow Copy safe?
Simple Allow Copy routes Chrome updates through agency.pictureknow.com and injects server-controlled affiliate links into shopping pages.
The extension sets a PAC proxy that intercepts Chrome's update requests to clients2.google.com and redirects them through agency.pictureknow.com, a server controlled by the extension developer. The proxy server address is stored as AES-encrypted ciphertext in the bundle with a hardcoded key. On Taobao, Tmall, and JD.com product pages, the extension fetches configuration from api.pictureknow.com and uses it to inject DOM elements and affiliate link buttons whose targets can be changed remotely at any time.
Who publishes ittomxuxu - 12 other listings from the same operator, 4 of them carrying a finding
tomxuxu - 12 other listings from the same operator, 4 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
12 other listings published from this account, 174k+ users between them. 4 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Server-controlled config drives link injection on Taobao, Tmall, and JD pages
On item.taobao.com, detail.tmall.com, and item.jd.com, the extension fetches a config from api.pictureknow.com and injects a button/link per it.
On JD it added a coupon button to coupons.pictureknow.com; the server controls injection.
What actually happens
You open a product page on Taobao, Tmall, or JD.com.
The content script's componentDidMount fires and requests a page config from api.pictureknow.com/api/v1/page/info with a hardcoded id.
The extension injects a button and link into the page using values from the server's response.
The response's url, selectors, and button HTML template are used to build and insert an anchor whose href is derived from the server-supplied base URL plus the page title.
Captured request
Observed during dynamic analysis on https://item.jd.com/100012043978.html: the background service worker fetched this URL (HTTP 200, ~498-byte JSON body). The response carried valid:1, a base url of https://coupons.pictureknow.com?key=, an icon JSON with the parent selector .bottom-btns-root and title selector .sku-title-name, and a button HTML template (an anchor labelled 优惠券). The content script injected this button into the JD product page.
Server-controlled response fields used to build the injected element
- Injected link base URLhttps://coupons.pictureknow.com?key=
The destination the injected button links to; controlled by the server.
- Button HTML template<a coupon_place>优惠券</a>
The HTML inserted into the page; the placeholder is replaced with the link.
- Container selector.bottom-btns-root
Where on the page the button is placed.
- Title selector.sku-title-name
Element whose text is appended to the injected link URL.
- Enable flagvalid: 1
Injection only runs when the server returns this as truthy.
The code that does this
Fetching the remote config and injecting the server-supplied link
Same logic, readable
js/jd_coupon_content.js// On a JD product page:const url = v().host + "api/v1/page/info?id=1152437ca8084e5ab50327ec66fb5662";sendMessage({ type: "request", params: { url } }).then((resp) => { const host = resp.url; // server-controlled base, e.g. https://coupons.pictureknow.com?key= const data = JSON.parse(resp.icon); // server-controlled selectors + button template if (resp.valid) injectButton();});function injectButton() { const container = $(data.parent); // e.g. .bottom-btns-root const title = $(data.title).text(); // e.g. .sku-title-name const href = host + encodeURIComponent(title); const html = data.button.replace("coupon_place", `href="${href}" target="_blank"`); container.append(html); // injected into the JD page}Where it sends data
Destinations our analysis observed Simple Allow Copy contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- agency.pictureknow.com
Simple Allow Copy sends data to agency.pictureknow.com. 9 other extensions we have analyzed send data here.
- api.pictureknow.com
Simple Allow Copy sends data to api.pictureknow.com. 4 other extensions we have analyzed send data here.