Is TM蛙 · Temu图片下载 safe?
TM蛙 Temu image downloader sends the full URL of every page you visit to huoxiaqu.com.
A content script runs on all websites and, on each page load, reports the page's host and full URL (including query strings) to the extension's background script. The background script forwards these with a stored user ID, session ID and paid-user flag to huoxiaqu.com. This is separate from the Temu image-download feature, which is limited to temu.com pages.
Who publishes itDo It - 7 other listings from the same operator, 6 of them carrying a finding
Do It - 7 other listings from the same operator, 6 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
7 other listings published from this account, 1k+ users between them. 6 of them carry a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Page address of every site you open is sent to huoxiaqu.com with a persistent ID
Code analysis shows a Temu image downloader reports the full address and host of every page loaded to huoxiaqu.com, with a stored user and session ID.
Nothing in the code limits this to Temu.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
You open any web page, not only Temu.
The extension sends that page's host and full address to huoxiaqu.com, tagged with an ID that persists across visits.
Content script and handler that forward each page address
background.js message handler
js/background.jscase "recordVisitor": k(e.fromChannel, e.host, e.url), s({ success: !0 }); break;background.js sender function
js/background.jschrome.storage.local.get(["userId", "sessionId", "paidUsers"], function(r) { r.sessionId || (r.sessionId = Math.random().toString(36).substr(2, 10), chrome.storage.local.set({ sessionId: r.sessionId })), v.recordVisitor({ userId: r.userId, fromChannel: e, sessionId: r.sessionId, host: o, url: s, paidUsers: r.paidUsers }).catch(t => console.log("Error:", t))})assets/request-rLoKy0lH.js endpoint
assets/request-rLoKy0lH.jsrecordVisitor: async e => { const t = await Se("/api/visitor/visitorRecord", { method: "POST", body: e }); return t && typeof t == "object" && "error" in t, t}- Full page URLhttps://www.example.com/account/orders?id=48213
The complete address of the page, including any query string.
- Page hostwww.example.com
The site you are visiting.
- User IDu_83f2a1c9
A stored identifier for your install or account.
- Session IDk3m9x2q7ab
A random 10 character ID kept in extension storage.
- Paid-user flagfalse
Whether the install is marked as a paid user.
- Source channelcontent
Which extension part produced the record.
- huoxiaqu.com
Receives POST /api/visitor/visitorRecord with page URL, host and IDs. Appears to be the extension vendor's backend.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed TM蛙 · Temu图片下载 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- huoxiaqu.com
TM蛙 · Temu图片下载 sends data to huoxiaqu.com. 6 other extensions we have analysed send data here.