Is 达秘TikTok批量建联&管理达人工具 safe?

High risk

达秘TikTok批量建联&管理达人工具 is high risk. When a workbench action requests a task, the background worker fetches JavaScript from cos-res.tikclubs.com and runs it in the page context of TikTok or Tokopedia affiliate pages, exposing the page and task parameters to that remote code.

萌啦科技v2.1.2Chrome Web Store
72Risk
Who publishes it

广州萌啦信息科技有限公司 - 11 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
萌啦科技
Declared legal entity
广州萌啦信息科技有限公司
Registered address
坑田大街32号, Guangzhou Shi, Guangdong Sheng 510700, CN
Registered contact
广州萌啦信息科技有限公司

Same store account

3 other listings published from this account, 24k+ users between them, none of them carrying a finding.

Same operator - 8 listings

Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.

Shared hosts - 5 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

cos-res.tikclubs.com
Also called by 1 other listing: DAMI - Công cụ kết nối & quản lý KOL TikTok toàn diện
api-partner-sg.tiktokshop.com
Also called by 2 other listings, including DAMI - Công cụ kết nối & quản lý KOL TikTok toàn diện
partner.eu.tiktokshop.com
Also called by 4 other listings, including DAMI - Công cụ kết nối & quản lý KOL TikTok toàn diện
partner.tiktokshop.com
Also called by 4 other listings, including DAMI - Công cụ kết nối & quản lý KOL TikTok toàn diện
api-partner-va.tiktokshop.com
Also called by 5 other listings, including 达连-让TikTok达人邀约更简单

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote TikClubs JavaScript runs on affiliate pages

When a workbench action requests a task, the background worker fetches JavaScript from cos-res.tikclubs.com and runs it in the page context of TikTok or Tokopedia affiliate pages, exposing the page and task parameters to that remote code.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You start a TikTok or Tokopedia affiliate workbench task.

The page listener treats the workbench event type as an instruction to execute task code.

The extension did this

The extension downloads TikClubs JavaScript and inserts it into the affiliate page.

The background service worker fetches the remote files, joins their source text, and executes the combined code in the page context.

Captured request
GEThttps://cos-res.tikclubs.com/dami/scripts/v2-2.0.0/prod/CSharpCode.js

JavaScript source response; the GET request has no request body recorded.

Concrete data made available to the remote execution path
  • Affiliate page URL
    https://affiliate-us.tiktok.com/*

    Shows which TikTok or Tokopedia affiliate workspace is open when the remote code runs.

  • Page DOM content
    <script class="dm-custom-js">remote task code</script>

    Lets the remote script read or change the affiliate page that is open in your browser.

  • Task parameters
    taskType: sampleAction; orderId: 981234567890; shopInfo.site_code: US

    Carries the task and shop values that the extension passes into the injected script.

  • Script list
    CSharpCode.js, GlobalData.js, Rpa.js, RpaChat.js, damiTikTokApi.js

    Identifies the remote files the extension downloads before running the task.

The code that does this

Workbench event relay, remote script fetch, and page insertion

Readable version

Content script relay from page event to background message

content-scripts/content.js
window.addEventListener("DAMI_WORKBENCH_CUTSOM_EVENT", async event => {  if (!event.detail.type) return;  const detail = event && event.detail ? event.detail : {};  const { type, data } = detail;  if (type === "execute-script") {    chrome.runtime.sendMessage({      type: "bg-execute-script",      data,      timestamp: Date.now()    });  }});

Background message branch builds the remote script URL list

background.js
else if (message.type === "bg-execute-script") {  const { tab } = sender;  chrome.tabs.sendMessage(contentTab.id, {    type: "tabs-get-common-info",    timestamp: Date.now()  }).then(commonInfo => {    const scriptParams = { ...commonInfo, ...message.data };    scriptParams.envMode = "production";    const base = "https://cos-res.tikclubs.com/dami/scripts/v2-2.0.0/prod";    scriptParams.scriptUrls = [      `${base}/CSharpCode.js`,      `${base}/GlobalData.js`,      `${base}/Rpa.js`,      `${base}/RpaChat.js`,      `${base}/damiAdminApi.js`,      `${base}/damiTikTokApi.js`,      `${base}/content.js`,      `${base}/protobuf.js`,      `${base}/dami_lang_en.js`    ];    if (message.data?.taskType === "review-sample-request") {      scriptParams.orderId = message.data.orderId;      scriptParams.taskType = "sampleAction";      scriptParams.sampleActionSetting = message.data.setting;    } else if (message.data?.taskType === "chat-sample-creator") {      scriptParams.orderId = message.data.orderId;      scriptParams.taskType = "sampleChat";      scriptParams.creatorMode = "chatSampleCreator";    } else if (message.data?.taskType === "synShpoVideoData") {      scriptParams.taskType = "synShpoVideoData";    } else if (message.data?.taskType === "syncProductCreatorRelation") {      scriptParams.taskType = "syncProductCreatorRelation";      scriptParams.productJson = message.data.productJson;    }    scriptParams.envMode = "production";    scriptParams.isCdd = "0";    j0(scriptParams, sender.tab);  }).catch(console.error);}

Remote scripts are fetched and executed in the main world

background.js
async function j0(scriptParams, target) {  if (!scriptParams.scriptUrls) return;  scriptParams.envMode = "production";  const urls = scriptParams.scriptUrls.map(url => url + `?timest=${Date.now()}`);  Promise.all(urls.map(url =>    fetch(url)      .then(response => {        if (!response.ok) {          throw new Error(`Failed to load script: ${url} (Status: ${response.status})`);        }        return response.text();      })      .catch(error => {        console.error(error);        return "";      })  )).then(async scriptTexts => {    const joinedSource = scriptTexts.join("\n");    let targetTab = null;    if (target === "tk") {      const siteFlag = scriptParams?.shopInfo.site_id === "8" ? 1 : 0;      const siteCode = scriptParams?.shopInfo.site_code;      const isTap = !!scriptParams?.shopInfo.is_tap;      targetTab = await U0(siteFlag, siteCode, isTap);    } else {      targetTab = target;    }    if (targetTab) {      await tg(targetTab);      await chrome.scripting.executeScript({        args: [joinedSource, scriptParams],        target: { tabId: targetTab.id },        world: "MAIN",        func: Yx      });    }  });}

Fetched source is appended as a page script element

background.js
function Yx(scriptSource, scriptParams, extra = []) {  const paramsJson = JSON.stringify(scriptParams);  function automaFetchBridge(id, { type, resource }) {    return new Promise((resolve, reject) => {      if (!type || !["text", "json", "base64"].includes(type)) {        reject(new Error('The "type" must be "text" or "json"'));        return;      }      const eventName = `__automa-dm-fetch-response-${id}__`;      const listener = ({ detail }) => {        if (detail.id === id) {          window.removeEventListener(eventName, listener);          detail.isError ? reject(new Error(detail.result)) : resolve(detail.result);        }      };      window.addEventListener(eventName, listener);      window.dispatchEvent(new CustomEvent("__automa-dm-fetch__", {        detail: { id, type, resource }      }));    });  }  function automaUploadBridge(id, { url }) {    return new Promise((resolve, reject) => {      const eventName = `__upload-image-response-${id}__`;      const listener = ({ detail }) => {        if (detail.id === id) {          window.removeEventListener(eventName, listener);          detail.isError ? reject(new Error(detail.result)) : resolve(detail.result);        }      };      window.addEventListener(eventName, listener);      window.dispatchEvent(new CustomEvent("__upload-image__", { detail: { id, url } }));    });  }  return new Promise(() => {    try {      const script = document.createElement("script");      script.setAttribute("block--1", "");      script.classList.add("dm-custom-js");      script.textContent = `(() => {        function automaFetch(type, resource, id) {          return (${automaFetchBridge})(id, { type, resource });        }        function automaUpload(id, url) {          return (${automaUploadBridge})(id, { url });        }        window.automaFetch = automaFetch;        window.automaUpload = automaUpload;        let scriptParams = ${paramsJson};        ${scriptSource}      })()`;      document.head.appendChild(script);    } catch (error) {      console.error(error);    }  });}
Remote host contacted by this execution path
    • cos-res.tikclubs.com

    Hosts the TikClubs JavaScript files that the service worker fetches before executing the joined source in the affiliate page.

Updated 30 September 2026nhpgibkafngkpkjlkhnfipkalhkkbebo