Is THunt - Temu™永久免费商品数据分析 & 下载工具 safe?

High risk

thunt-temu%E6%B0%B8%E4%B9%85%E5%85%8D%E8%B4%B9%E5%95%86%E5%93%81%E6%95%B0%E6%8D%AE%E5%88%86%E6%9E%90-%E4%B8%8B%E8%BD%BD%E5%B7%A5%E5%85%B7 is high risk. On temu.com, the content script reads page product data (window.rawData, goodsList) and sends it to temuhunt.com.…

knhcfsgv1.7.6Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Browsing temu.com sends the product listings you view to temuhunt.com

On temu.com, the content script reads page product data (window.rawData, goodsList) and sends it to temuhunt.com.

Captured POST to .../new_goods_list_save_v2: gzip+base64 JSON with product IDs, titles, prices, URLs, sales counts.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You open a product or listing page on temu.com.

The content script registered for *://*.temu.com/* runs at document_start and reads the page on DOMContentLoaded.

The extension did this

The extension sends the product listings on the page to temuhunt.com without asking.

We captured an automatic POST to temuhunt.com/api/plugin/new_goods_list_save_v2 carrying the gzip-compressed product data.

02EvidenceFIELD TABLE
Fields we decoded from the captured payload (gunzipped goods_list array)
FieldValueWhy it matters
Product ID
601099512345678Identifies the specific Temu product you were viewing.
Product title
Wireless Bluetooth Earbuds, Noise CancellingThe listing title of the product on the page.
Price
£12.99 GBPThe displayed price and currency for the product on your page.
Listing URL
https://www.temu.com/...-g-601099512345678.htmlThe direct link to the product listing you were viewing.
Sales count
10K+ soldThe number of sales shown for the product.
Region / language
region: 210, language: enYour Temu storefront region and language, read from window.rawData.store.localInfo and added to each product record.
03EvidenceOPAQUE REVEAL
Why you can't catch this in DevTools

The request body is sent as base64-encoded gzip in a `compressedData` field, so the product data is not readable in the raw request. Decoding it (base64 -> gunzip) reveals the product listings.

What's actually being sent
{"goods_list":[{"goods_id":"601099512345678","title":"Wireless Bluetooth Earbuds, Noise Cancelling","price_info":{"price":"12.99","currency":"GBP"},"seo_link_url":"https://www.temu.com/...-g-601099512345678.html","sales_num":"10K+ sold","p_rec":{"region":"210","language":"en"}}, ... <one record per product listing on the page> ]}
04EvidenceCODE COMPARE
The code that does this

Content script reads product data, enriches it, compresses it, forwards it for POSTing

What it actually does
// content.js — read page product data and send it to the background
const NEW_PRODUCT = 'new_product_save_v2', NEW_GOODS_LIST = 'new_goods_list_save_v2', NEW_STORE = 'new_store_save_v2';

function sendScraperRequest(endpoint, payload) {           // Uht
  let req = { type:'scraper_request', response_type:'json',
              url: endpoint, config:{ method:'post', body: JSON.stringify(payload), headers:{'Content-Type':'application/json'} } };
  req = compress(req);                                     // zht(): gzip body -> base64 -> {compressedData, anti_content}
  chrome.runtime.sendMessage(req);                         // background does fetch('https://temuhunt.com/api/plugin/'+url, config)
}

function enrich(list) {                                    // $ht(): inject storefront language/region into each product
  const lang = window.rawData?.store?.localInfo?.language || '';
  const region = window.rawData?.store?.localInfo?.region || '';
  return list.map(item => { const a = item.data || item; const p = a.p_rec || {}; p.language = lang; p.region = region; a.p_rec = p; return a; });
}

function sendGoodsList(list){ sendScraperRequest(NEW_GOODS_LIST, { goods_list: enrich(list) }); }   // Ght
function onLoad(){ const list = window.rawData?.store?.goodsList; if (list?.length) sendGoodsList(list); }  // Qht, called on DOMContentLoaded
05EvidenceNETWORK CAPTURE
Captured request
POSThttps://temuhunt.com/api/plugin/new_goods_list_save_v2?time=<unix>&sign=<md5>
Fired automatically from the background service worker when we navigated to www.temu.com. The compressedData field decompressed to 34143 bytes of {goods_list:[...]} product listings (goods_id, title, price in GBP, seo_link_url, sales_num, p_rec{region,language}).
Headers
Content-Typeapplication/json
Body
{
  "compressedData": "<base64 gzip, 11519 bytes on the wire>",
  "anti_content": "<messagePack token>"
}
06EvidenceTHIRD PARTY LIST
Where the product data is sent
  • temuhunt.com

    Receives product listings, product detail, and store detail read from temu.com (new_goods_list_save_v2, new_product_save_v2, new_store_save_v2). Operated by the vendor, THunt.

07EvidenceARTIFACT
Check if you're affected

Decodes a captured new_goods_list_save_v2 request body. Pass the JSON body (with the compressedData field) on stdin; it base64-decodes and gunzips compressedData and prints the product listings.

RequiresNode.js 18+
decode-temuhunt-body.js · js
// Usage: node decode-temuhunt-body.js < captured_body.json
// captured_body.json is the raw POST body to temuhunt.com/api/plugin/new_goods_list_save_v2
const zlib = require('zlib');
let input = '';
process.stdin.on('data', d => input += d);
process.stdin.on('end', () => {
  const { compressedData } = JSON.parse(input);
  const gz = Buffer.from(compressedData, 'base64');
  const json = zlib.gunzipSync(gz).toString('utf8');
  const obj = JSON.parse(json);
  const list = obj.goods_list || [];
  console.log(`Decoded ${list.length} product listing(s):`);
  for (const g of list) {
    console.log(`- ${g.goods_id}  ${g.title}  ${g.price_info?.currency} ${g.price_info?.price}  ${g.seo_link_url}`);
  }
});
How to run it
  1. 1
    In DevTools > Network, find the POST to temuhunt.com/api/plugin/new_goods_list_save_v2, copy its body to captured_body.json.
  2. 2
    Run node decode-temuhunt-body.js < captured_body.json.
  3. 3
    Read the decoded listings sent.
Updated 17 September 2026gclgnfnkkgjammaplobpkodeojpgfdig