Is THunt - Temu™永久免费商品数据分析 & 下载工具 safe?
thunt-temu%E6%B0%B8%E4%B9%85%E5%85%8D%E8%B4%B9%E5%95%86%E5%93%81%E6%95%B0%E6%8D%AE%E5%88%86%E6%9E%90-%E4%B8%8B%E8%BD%BD%E5%B7%A5%E5%85%B7 is high risk. On temu.com, the content script reads page product data (window.rawData, goodsList) and sends it to temuhunt.com.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Browsing temu.com sends the product listings you view to temuhunt.com
On temu.com, the content script reads page product data (window.rawData, goodsList) and sends it to temuhunt.com.
Captured POST to .../new_goods_list_save_v2: gzip+base64 JSON with product IDs, titles, prices, URLs, sales counts.
You open a product or listing page on temu.com.
The content script registered for *://*.temu.com/* runs at document_start and reads the page on DOMContentLoaded.
The extension sends the product listings on the page to temuhunt.com without asking.
We captured an automatic POST to temuhunt.com/api/plugin/new_goods_list_save_v2 carrying the gzip-compressed product data.
| Field | Value | Why it matters | |
|---|---|---|---|
Product ID | 601099512345678 | Identifies the specific Temu product you were viewing. | |
Product title | Wireless Bluetooth Earbuds, Noise Cancelling | The listing title of the product on the page. | |
Price | £12.99 GBP | The displayed price and currency for the product on your page. | |
Listing URL | https://www.temu.com/...-g-601099512345678.html | The direct link to the product listing you were viewing. | |
Sales count | 10K+ sold | The number of sales shown for the product. | |
Region / language | region: 210, language: en | Your Temu storefront region and language, read from window.rawData.store.localInfo and added to each product record. |
The request body is sent as base64-encoded gzip in a `compressedData` field, so the product data is not readable in the raw request. Decoding it (base64 -> gunzip) reveals the product listings.
{"goods_list":[{"goods_id":"601099512345678","title":"Wireless Bluetooth Earbuds, Noise Cancelling","price_info":{"price":"12.99","currency":"GBP"},"seo_link_url":"https://www.temu.com/...-g-601099512345678.html","sales_num":"10K+ sold","p_rec":{"region":"210","language":"en"}}, ... <one record per product listing on the page> ]}Content script reads product data, enriches it, compresses it, forwards it for POSTing
// content.js — read page product data and send it to the background
const NEW_PRODUCT = 'new_product_save_v2', NEW_GOODS_LIST = 'new_goods_list_save_v2', NEW_STORE = 'new_store_save_v2';
function sendScraperRequest(endpoint, payload) { // Uht
let req = { type:'scraper_request', response_type:'json',
url: endpoint, config:{ method:'post', body: JSON.stringify(payload), headers:{'Content-Type':'application/json'} } };
req = compress(req); // zht(): gzip body -> base64 -> {compressedData, anti_content}
chrome.runtime.sendMessage(req); // background does fetch('https://temuhunt.com/api/plugin/'+url, config)
}
function enrich(list) { // $ht(): inject storefront language/region into each product
const lang = window.rawData?.store?.localInfo?.language || '';
const region = window.rawData?.store?.localInfo?.region || '';
return list.map(item => { const a = item.data || item; const p = a.p_rec || {}; p.language = lang; p.region = region; a.p_rec = p; return a; });
}
function sendGoodsList(list){ sendScraperRequest(NEW_GOODS_LIST, { goods_list: enrich(list) }); } // Ght
function onLoad(){ const list = window.rawData?.store?.goodsList; if (list?.length) sendGoodsList(list); } // Qht, called on DOMContentLoaded| Content-Type | application/json |
{
"compressedData": "<base64 gzip, 11519 bytes on the wire>",
"anti_content": "<messagePack token>"
}- temuhunt.com
Receives product listings, product detail, and store detail read from temu.com (new_goods_list_save_v2, new_product_save_v2, new_store_save_v2). Operated by the vendor, THunt.
Decodes a captured new_goods_list_save_v2 request body. Pass the JSON body (with the compressedData field) on stdin; it base64-decodes and gunzips compressedData and prints the product listings.
// Usage: node decode-temuhunt-body.js < captured_body.json
// captured_body.json is the raw POST body to temuhunt.com/api/plugin/new_goods_list_save_v2
const zlib = require('zlib');
let input = '';
process.stdin.on('data', d => input += d);
process.stdin.on('end', () => {
const { compressedData } = JSON.parse(input);
const gz = Buffer.from(compressedData, 'base64');
const json = zlib.gunzipSync(gz).toString('utf8');
const obj = JSON.parse(json);
const list = obj.goods_list || [];
console.log(`Decoded ${list.length} product listing(s):`);
for (const g of list) {
console.log(`- ${g.goods_id} ${g.title} ${g.price_info?.currency} ${g.price_info?.price} ${g.seo_link_url}`);
}
});- 1In DevTools > Network, find the POST to temuhunt.com/api/plugin/new_goods_list_save_v2, copy its body to captured_body.json.
- 2Run node decode-temuhunt-body.js < captured_body.json.
- 3Read the decoded listings sent.