Is TEMU Hide Local Products safe?

Medium risk

TEMU Hide Local Products fetches rules from iltekin.com that can alter Temu pages and add affiliate parameters to Temu URLs.

On Temu pages, the extension fetches a JSON configuration from iltekin.com and applies any supplied rules to matching page elements. Those rules can hide, remove, or restyle elements, and supplied affiliate parameters are added to Temu links and the current Temu URL.

iltekinv1.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote Server Controls DOM Edits and Link Params on Temu Pages

TEMU Hide Local Products has an optional 'affiliate' toggle.

Enabled, every temu.com visit fetches JSON from iltekin.com and runs it: hide/restyle elements, append params to Temu links and the tab URL, no allow-list on server content.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You turn on the extension's optional 'affiliate' toggle and browse to any temu.com page.

The extension did this

The extension fetches a JSON instruction file from iltekin.com and carries out whatever hide, remove, restyle, or link-rewrite rules it contains, on any element on the page.

There is no allow-list on which CSS selectors or which link parameters the server can send, the extension applies the response as-is.

Captured request
GEThttps://iltekin.com/extensions/remove-local-temu/data.json

HTTP 200, application/json. Body observed during dynamic analysis: { "params": [ { "key": "referral_code", "value": "none" }, { "key": "src", "value": "none" } ], "actions": [ { "comment": "Remove the newsletter popup completely", "selector": ".newsletter-popup-container", "action": "remove" }, { "comment": "Hide any element with 'Sponsored' label by finding its parent product card", "selector": "span.sponsored-label", "traverse": "closest('.product-card')", "action": "hide" }, { "comment": "Hide a specific banner only on the cart page", "selector": ".upsell-banner", "url_contains": "/cart", "action": "hide" }, { "comment": "Change height", "selector": ".xyz", "action": "style", "style": { "height": "300px", "border": "2px solid red" } }, { "comment": "Remove the parent of a specific ad container (1 level up)", "selector": ".ad-placeholder", "traverse": "parent", "action": "remove" }, { "comment": "Remove the grandparent of a specific tracking pixel (2 levels up)", "selector": "img.tracker-pixel", "traverse": "parent.parent", "action": "remove" } ], "local_keywords": ["Yerel", "Local", "Domestic"] }

What the remote server can instruct the extension to do on any Temu page you visit
  • CSS selector to target
    span.sponsored-label

    Any selector the server sends is matched against the live Temu page with querySelectorAll, not limited to a fixed list of elements.

  • Action to take
    remove

    hide (display:none), remove (delete from the DOM), or style (overwrite arbitrary CSS properties) on the matched element.

  • Element traversal
    closest('.product-card')

    Optionally walks to the matched element's closest() ancestor, parent, or grandparent first, widening what a single selector can affect.

  • Affiliate link parameter
    referral_code=none

    A key/value pair appended to every outbound Temu link on the page and to your current tab's URL, if not already present.

Page DOM modified

Every Temu link on the page (80 observed on one test page) and the address bar itself get the server-supplied key/value pairs appended, without any click or navigation by the user, done via history.replaceState so the address bar changes with no page reload.

Target
Temu anchor links and the current tab URL on any temu.com page
Before
<a href="https://www.temu.com/uk/channel/best-sellers.html">Best Sellers</a>window.location.href = "https://www.temu.com/"
After the extension changed it
<a href="https://www.temu.com/uk/channel/best-sellers.html?referral_code=none&src=none" data-affiliate-applied="true">Best Sellers</a>window.location.href = "https://www.temu.com/?referral_code=none&src=none"
Who controls what happens to the page you're viewing
    • iltekin.com

    Serves the JSON instructions fetched on every Temu page load once affiliate mode is on. Registered to the listed developer; reachable via host_permissions https://iltekin.com/*.

Reproduce it yourself

Paste into the DevTools console on a temu.com tab (with the extension's affiliate toggle enabled) to print every remote action/param rule the extension is about to apply, before it runs.

Requires
  • Chrome with the extension installed and its affiliate toggle enabled
iltekin-config-watch.js · js
// iltekin-config-watch.js// Run in the page console on a temu.com tab with the extension's// 'affiliate' feature enabled. Reads the cached remote config the// extension already fetched into chrome.storage.local.affiliateData// and prints the DOM rules and link params it will apply.chrome.storage.local.get(['affiliateData'], (result) => {  if (!result.affiliateData) {    console.log('[iltekin-config-watch] no affiliateData cached yet — enable the affiliate toggle and reload.');    return;  }  const { params, actions, local_keywords } = result.affiliateData;  console.log('[iltekin-config-watch] link/URL params the extension will append:', params);  console.log('[iltekin-config-watch] DOM actions the extension will run on this page:', actions);  if (local_keywords) console.log('[iltekin-config-watch] local-seller keywords in use:', local_keywords);});
How to run it
  1. 1Install and enable the 'affiliate' toggle.
  2. 2Open any temu.com page.
  3. 3Open DevTools Console (page context, not the service worker).
  4. 4Paste and run this script.
  5. 5Read the printed params/actions: what iltekin.com returned.

What it can do

Permissions this extension asks for, as declared in version 1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on iltekin.com

    https://iltekin.com/*

  • Act on the current tab, but only after you click the extension

    activeTab

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed TEMU Hide Local Products contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • iltekin.com

    TEMU Hide Local Products sends data to iltekin.com. No other extension we have analysed sends data here.

  • temu.com

    TEMU Hide Local Products sends data to temu.com. No other extension we have analysed sends data here.

Updated 30 September 2026eahpdbpdonhoddncfbodpjaegkhcfalc