Is THunt Image Downloader safe?
THunt Image Downloader collects Temu product and store page data and sends it to temuhunt.com.
When you browse Temu pages, its content script reads page data including raw page data, product and store IDs, goods lists, prices, images, sales and review counts, tags, region, language, and currency. The background script forwards that data to temuhunt.com API endpoints for products, stores, goods lists, and ranking data.
Who publishes itknhcfsg - 3 other listings from the same operator, 1 of them carrying a finding
knhcfsg - 3 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 38k+ users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
THunt automatically uploads Temu browsing and product data to temuhunt.com
On any Temu product, store, or search page, THunt's content script starts sending requests to temuhunt.com within seconds, with no click or prompt.
We observed a request firing automatically every 20 seconds during a single page visit.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a Temu product, store, or search-results page with THunt Image Downloader installed.
The content script is injected at document_start, before the page finishes loading.
The extension immediately starts polling Temu's ranking API and relaying page data to temuhunt.com.
This happens on every matching page load, with no click, popup, or consent prompt.
Every 20 seconds
Every 20 seconds, up to 20 times per page visit, the extension requests Temu ranking data and forwards it to temuhunt.com.
HTTP 200; server returned a JSON ranking configuration for the detected Temu region. Observed firing 14 times in a single test session, roughly every 20 seconds, starting while the browser was still on Temu's login page and before any sign-in completed.
- Content-Type
- application/json
{"compressedData":"H4sIAJ8poGoC/6tWKkpNz8zPi89MUbJSMjI0UKoFAOeTY7QTAAAA","anti_content":"<redacted>"} (compressedData shown is a like-for-like re-encoding of the captured payload using the extension's own gzip+base64 routine; the underlying value, region_id 210, matches what was captured)The 20-second polling loop and its relay to temuhunt.com
Readable equivalent - polling loop
function requestRankItem() { const region = window.rawData?.$localInfo?.region || window.rawData?.store?.localInfo?.region; if (!region || alreadyInFlight) return; alreadyInFlight = true; const message = { type: 'scraper_request', response_type: 'json', url: 'get_rank_item', config: { method: 'post', body: JSON.stringify({ region_id: region }), headers: { 'Content-Type': 'application/json' } } }; chrome.runtime.sendMessage(signAndCompress(message), (res) => { if (res && res.code === 10000 && res.data) { alreadyInFlight = false; handleRankResponse(res.data); } });}function startPollingLoop() { let ticks = 0; const timer = setInterval(() => { if (ticks >= 20) clearInterval(timer); ticks += 1; requestRankItem(); }, 20000);}Readable equivalent - background relay
const API_BASE = 'https://temuhunt.com/api/plugin/';chrome.runtime.onMessage.addListener((message, sender, sendResponse) => { if (message.type === 'scraper_request') { fetch(API_BASE + message.url, message.config) .then((res) => message.response_type === 'json' ? res.json() : res.text()) .then((data) => sendResponse(data)) .catch((err) => console.log(err)); } return true;});- Full page data blobwindow.rawData (product detail, store detail, or goods list, depending on the page)
The page's entire inline window.rawData object, including product, store, and listing details, is attached to every upload.
- Product or store IDproduct_id: 601099623456789
Identifies which specific Temu product or storefront the data came from.
- Listing detailstitle, price, image.url, sales_num, comment.goods_score
Titles, prices, sale prices, image URLs, sales counts, review counts, and tags for each item on the page.
- Region, language, currencyregion: 210, language: en, currency: USD
The Temu storefront locale the data was collected under.
- Ranking query resultrank_info + goods_list for a given category/filter
Temu's own search-ranking results for the current category, fetched using session tokens read from the page.
This session captured the get_rank_item loop firing automatically. Product/store upload endpoints share the same code path but a Temu login wall blocked reaching a product page, so they were not captured firing here.
- temuhunt.com
The developer's own backend for THunt, a Temu product-research service. The Chrome listing for this extension only describes an image and video downloader.
Where it sends data
Destinations our analysis observed THunt Image Downloader contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- temuhunt.com
THunt Image Downloader sends data to temuhunt.com. 2 other extensions we have analysed send data here.