Is THunt - Temu™永久免费商品数据分析 & 下载工具 safe?

Findings

{"goods_list":[{"goods_id":"601099512345678","title":"Wireless Bluetooth Earbuds, Noise Cancelling","price_info":{"price":"12.99","currency":"GBP"},"seo_link_url":"https://www.temu.com/...-g-601099512345678.html","sales_num":"10K+ sold","p_rec":{"region":"210","language":"en"}}, ... <one record per product listing on the page> ]}

// content.js — read page product data and send it to the backgroundconst NEW_PRODUCT = 'new_product_save_v2', NEW_GOODS_LIST = 'new_goods_list_save_v2', NEW_STORE = 'new_store_save_v2';function sendScraperRequest(endpoint, payload) {           // Uht  let req = { type:'scraper_request', response_type:'json',              url: endpoint, config:{ method:'post', body: JSON.stringify(payload), headers:{'Content-Type':'application/json'} } };  req = compress(req);                                     // zht(): gzip body -> base64 -> {compressedData, anti_content}  chrome.runtime.sendMessage(req);                         // background does fetch('https://temuhunt.com/api/plugin/'+url, config)}function enrich(list) {                                    // $ht(): inject storefront language/region into each product  const lang = window.rawData?.store?.localInfo?.language || '';  const region = window.rawData?.store?.localInfo?.region || '';  return list.map(item => { const a = item.data || item; const p = a.p_rec || {}; p.language = lang; p.region = region; a.p_rec = p; return a; });}function sendGoodsList(list){ sendScraperRequest(NEW_GOODS_LIST, { goods_list: enrich(list) }); }   // Ghtfunction onLoad(){ const list = window.rawData?.store?.goodsList; if (list?.length) sendGoodsList(list); }  // Qht, called on DOMContentLoaded

{  "compressedData": "<base64 gzip, 11519 bytes on the wire>",  "anti_content": "<messagePack token>"}

// Usage: node decode-temuhunt-body.js < captured_body.json// captured_body.json is the raw POST body to temuhunt.com/api/plugin/new_goods_list_save_v2const zlib = require('zlib');let input = '';process.stdin.on('data', d => input += d);process.stdin.on('end', () => {  const { compressedData } = JSON.parse(input);  const gz = Buffer.from(compressedData, 'base64');  const json = zlib.gunzipSync(gz).toString('utf8');  const obj = JSON.parse(json);  const list = obj.goods_list || [];  console.log(`Decoded ${list.length} product listing(s):`);  for (const g of list) {    console.log(`- ${g.goods_id}  ${g.title}  ${g.price_info?.currency} ${g.price_info?.price}  ${g.seo_link_url}`);  }});

What it can do

Permissions this extension asks for, as declared in version 1.7.8. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

• Read and change your data on temu.com

  *://*.temu.com/*

• Read and change your data on thunt.ai

  *://*.thunt.ai/*

• See the address and title of every tab you have open

  tabs

• Store data in your browser

  storage

Where it sends data

Destinations our analysis observed thunt-temu%E6%B0%B8%E4%B9%85%E5%85%8D%E8%B4%B9%E5%95%86%E5%93%81%E6%95%B0%E6%8D%AE%E5%88%86%E6%9E%90-%E4%B8%8B%E8%BD%BD%E5%B7%A5%E5%85%B7 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

• www.amazon.com

  thunt-temu%E6%B0%B8%E4%B9%85%E5%85%8D%E8%B4%B9%E5%95%86%E5%93%81%E6%95%B0%E6%8D%AE%E5%88%86%E6%9E%90-%E4%B8%8B%E8%BD%BD%E5%B7%A5%E5%85%B7 sends data to www.amazon.com. 9 other extensions we have analyzed send data here.

• temuhunt.com

  thunt-temu%E6%B0%B8%E4%B9%85%E5%85%8D%E8%B4%B9%E5%95%86%E5%93%81%E6%95%B0%E6%8D%AE%E5%88%86%E6%9E%90-%E4%B8%8B%E8%BD%BD%E5%B7%A5%E5%85%B7 sends data to temuhunt.com. 5 other extensions we have analyzed send data here.

• m.shein.com

  thunt-temu%E6%B0%B8%E4%B9%85%E5%85%8D%E8%B4%B9%E5%95%86%E5%93%81%E6%95%B0%E6%8D%AE%E5%88%86%E6%9E%90-%E4%B8%8B%E8%BD%BD%E5%B7%A5%E5%85%B7 sends data to m.shein.com. One other extension we have analyzed sends data here.

• img.yiwugo.com

  thunt-temu%E6%B0%B8%E4%B9%85%E5%85%8D%E8%B4%B9%E5%95%86%E5%93%81%E6%95%B0%E6%8D%AE%E5%88%86%E6%9E%90-%E4%B8%8B%E8%BD%BD%E5%B7%A5%E5%85%B7 sends data to img.yiwugo.com. No other extension we have analyzed sends data here.

• stream-upload.taobao.com

  thunt-temu%E6%B0%B8%E4%B9%85%E5%85%8D%E8%B4%B9%E5%95%86%E5%93%81%E6%95%B0%E6%8D%AE%E5%88%86%E6%9E%90-%E4%B8%8B%E8%BD%BD%E5%B7%A5%E5%85%B7 sends data to stream-upload.taobao.com. No other extension we have analyzed sends data here.