Is 达秘TikTok批量建联&管理达人工具 safe?
达秘TikTok批量建联&管理达人工具 is high risk. When a workbench action requests a task, the background worker fetches JavaScript from cos-res.tikclubs.com and runs it in the page context of TikTok or Tokopedia affiliate pages, exposing the page and task parameters to that remote code.
Who publishes it广州萌啦信息科技有限公司 - 11 other listings from the same operator, none carrying a finding
广州萌啦信息科技有限公司 - 11 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 24k+ users between them, none of them carrying a finding.
Same operator - 8 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 5 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote TikClubs JavaScript runs on affiliate pages
When a workbench action requests a task, the background worker fetches JavaScript from cos-res.tikclubs.com and runs it in the page context of TikTok or Tokopedia affiliate pages, exposing the page and task parameters to that remote code.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You start a TikTok or Tokopedia affiliate workbench task.
The page listener treats the workbench event type as an instruction to execute task code.
The extension downloads TikClubs JavaScript and inserts it into the affiliate page.
The background service worker fetches the remote files, joins their source text, and executes the combined code in the page context.
JavaScript source response; the GET request has no request body recorded.
- Affiliate page URLhttps://affiliate-us.tiktok.com/*
Shows which TikTok or Tokopedia affiliate workspace is open when the remote code runs.
- Page DOM content<script class="dm-custom-js">remote task code</script>
Lets the remote script read or change the affiliate page that is open in your browser.
- Task parameterstaskType: sampleAction; orderId: 981234567890; shopInfo.site_code: US
Carries the task and shop values that the extension passes into the injected script.
- Script listCSharpCode.js, GlobalData.js, Rpa.js, RpaChat.js, damiTikTokApi.js
Identifies the remote files the extension downloads before running the task.
Workbench event relay, remote script fetch, and page insertion
Content script relay from page event to background message
content-scripts/content.jswindow.addEventListener("DAMI_WORKBENCH_CUTSOM_EVENT", async event => { if (!event.detail.type) return; const detail = event && event.detail ? event.detail : {}; const { type, data } = detail; if (type === "execute-script") { chrome.runtime.sendMessage({ type: "bg-execute-script", data, timestamp: Date.now() }); }});Background message branch builds the remote script URL list
background.jselse if (message.type === "bg-execute-script") { const { tab } = sender; chrome.tabs.sendMessage(contentTab.id, { type: "tabs-get-common-info", timestamp: Date.now() }).then(commonInfo => { const scriptParams = { ...commonInfo, ...message.data }; scriptParams.envMode = "production"; const base = "https://cos-res.tikclubs.com/dami/scripts/v2-2.0.0/prod"; scriptParams.scriptUrls = [ `${base}/CSharpCode.js`, `${base}/GlobalData.js`, `${base}/Rpa.js`, `${base}/RpaChat.js`, `${base}/damiAdminApi.js`, `${base}/damiTikTokApi.js`, `${base}/content.js`, `${base}/protobuf.js`, `${base}/dami_lang_en.js` ]; if (message.data?.taskType === "review-sample-request") { scriptParams.orderId = message.data.orderId; scriptParams.taskType = "sampleAction"; scriptParams.sampleActionSetting = message.data.setting; } else if (message.data?.taskType === "chat-sample-creator") { scriptParams.orderId = message.data.orderId; scriptParams.taskType = "sampleChat"; scriptParams.creatorMode = "chatSampleCreator"; } else if (message.data?.taskType === "synShpoVideoData") { scriptParams.taskType = "synShpoVideoData"; } else if (message.data?.taskType === "syncProductCreatorRelation") { scriptParams.taskType = "syncProductCreatorRelation"; scriptParams.productJson = message.data.productJson; } scriptParams.envMode = "production"; scriptParams.isCdd = "0"; j0(scriptParams, sender.tab); }).catch(console.error);}Remote scripts are fetched and executed in the main world
background.jsasync function j0(scriptParams, target) { if (!scriptParams.scriptUrls) return; scriptParams.envMode = "production"; const urls = scriptParams.scriptUrls.map(url => url + `?timest=${Date.now()}`); Promise.all(urls.map(url => fetch(url) .then(response => { if (!response.ok) { throw new Error(`Failed to load script: ${url} (Status: ${response.status})`); } return response.text(); }) .catch(error => { console.error(error); return ""; }) )).then(async scriptTexts => { const joinedSource = scriptTexts.join("\n"); let targetTab = null; if (target === "tk") { const siteFlag = scriptParams?.shopInfo.site_id === "8" ? 1 : 0; const siteCode = scriptParams?.shopInfo.site_code; const isTap = !!scriptParams?.shopInfo.is_tap; targetTab = await U0(siteFlag, siteCode, isTap); } else { targetTab = target; } if (targetTab) { await tg(targetTab); await chrome.scripting.executeScript({ args: [joinedSource, scriptParams], target: { tabId: targetTab.id }, world: "MAIN", func: Yx }); } });}Fetched source is appended as a page script element
background.jsfunction Yx(scriptSource, scriptParams, extra = []) { const paramsJson = JSON.stringify(scriptParams); function automaFetchBridge(id, { type, resource }) { return new Promise((resolve, reject) => { if (!type || !["text", "json", "base64"].includes(type)) { reject(new Error('The "type" must be "text" or "json"')); return; } const eventName = `__automa-dm-fetch-response-${id}__`; const listener = ({ detail }) => { if (detail.id === id) { window.removeEventListener(eventName, listener); detail.isError ? reject(new Error(detail.result)) : resolve(detail.result); } }; window.addEventListener(eventName, listener); window.dispatchEvent(new CustomEvent("__automa-dm-fetch__", { detail: { id, type, resource } })); }); } function automaUploadBridge(id, { url }) { return new Promise((resolve, reject) => { const eventName = `__upload-image-response-${id}__`; const listener = ({ detail }) => { if (detail.id === id) { window.removeEventListener(eventName, listener); detail.isError ? reject(new Error(detail.result)) : resolve(detail.result); } }; window.addEventListener(eventName, listener); window.dispatchEvent(new CustomEvent("__upload-image__", { detail: { id, url } })); }); } return new Promise(() => { try { const script = document.createElement("script"); script.setAttribute("block--1", ""); script.classList.add("dm-custom-js"); script.textContent = `(() => { function automaFetch(type, resource, id) { return (${automaFetchBridge})(id, { type, resource }); } function automaUpload(id, url) { return (${automaUploadBridge})(id, { url }); } window.automaFetch = automaFetch; window.automaUpload = automaUpload; let scriptParams = ${paramsJson}; ${scriptSource} })()`; document.head.appendChild(script); } catch (error) { console.error(error); } });}- cos-res.tikclubs.com
Hosts the TikClubs JavaScript files that the service worker fetches before executing the joined source in the affiliate page.