Is Wildbox - продвинутая аналитика Wildberries safe?
Wildbox reads Wildberries' session and anti-bot cookies on wildberries.ru and attaches them to requests sent to wildbox.ru.
On wildberries.ru, wb.ru, and related pages, Wildbox's content script reads Wildberries' own session/anti-abuse cookies (x_wbaas_token, _wbauid) and a proof-of-work token stored in the page's localStorage. These values are attached as custom headers on every API call the extension's analytics widget makes to its own backend at wildbox.ru/api, regardless of which endpoint is being called.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Wildbox forwards your Wildberries anti-bot session tokens off-site
Code analysis shows Wildbox's shared request client reads Wildberries' own anti-bot session cookies and proof-of-work token on every wildberries.ru page, then attaches them as headers on every call it makes to wildbox.ru.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Static analysis
You browse any wildberries.ru, search.wb.ru, or catalog.wb.ru page with the Wildbox extension installed.
The extension reads Wildberries' anti-bot and visitor-id cookies plus a proof-of-work token, then attaches them as headers on every call it sends to wildbox.ru.
The same interceptor backs every one of the 42+ wildbox.ru/api call sites in the bundle, so it fires on ordinary background calls, not just an explicit login.
The interceptor that reads Wildberries' tokens and forwards them to wildbox.ru
function getSessionPowToken() { const result = localStorage.getItem("session-pow-token"); if (!result) return null; return JSON.parse(result);}// Shared axios client used by every wildbox.ru/api call in the bundle// (42+ call sites, e.g. /auth/profile/, /auth/profile/demo/, /company/demo_available/)const $api = axios.create({ baseURL: "https://wildbox.ru/api", paramsSerializer: { serialize: (params) => queryString.stringify(params, { arrayFormat: "comma" }) }});// Runs on EVERY request this client sends, regardless of which endpoint$api.interceptors.request.use(async (config) => { const wbaasToken = await window.cookieStore.get("x_wbaas_token"); // Wildberries' own anti-bot cookie if (wbaasToken?.value) config.headers.set("x-wbaas-token", wbaasToken.value); const wbauid = await window.cookieStore.get("_wbauid"); // Wildberries' own visitor-id cookie if (wbauid?.value) config.headers.set("wbauid", wbauid.value); const sessionPow = getSessionPowToken(); // Wildberries' own proof-of-work token if (sessionPow) config.headers.set("x-pow", sessionPow.token); return config;});- Anti-bot session tokenx-wbaas-token: 9f3e7c1a8b6d4e2f... (illustrative)
Confirms to Wildberries that your browser already passed its automated anti-bot check for this session.
- Wildberries visitor IDwbauid: 7f1a2e4c-88b0-4e51-9c3a-2d6f0a1b9e77 (illustrative)
A persistent identifier Wildberries assigns your browser to recognize you across visits.
- Proof-of-work challenge tokenx-pow: pow_3f9c2a7e5b1d... (illustrative)
Proves your browser solved Wildberries' anti-scraping computational challenge for this session.
- wildbox.ru
Wildbox's own backend, a separate company/product from Wildberries. Receives Wildberries' anti-bot and visitor-id tokens on every page load, not only on a Wildbox-specific action.
Reads the same cookies and localStorage key the extension forwards, so you can see what would be sent as x-wbaas-token/wbauid/x-pow on the next wildbox.ru/api call.
- Chromium-based browser (window.cookieStore API)
- A wildberries.ru tab
(async () => { const wbaas = await window.cookieStore.get("x_wbaas_token"); const wbauid = await window.cookieStore.get("_wbauid"); const powRaw = localStorage.getItem("session-pow-token"); const pow = powRaw ? JSON.parse(powRaw) : null; console.log("x-wbaas-token would be:", wbaas?.value ?? "(not set)"); console.log("wbauid would be:", wbauid?.value ?? "(not set)"); console.log("x-pow would be:", pow?.token ?? "(not set)");})();- 1Open wildberries.ru with Wildbox installed.
- 2Open DevTools Console.
- 3Paste and run this script.
- 4Compare output to the x-wbaas-token/wbauid/x-pow headers on any wildbox.ru/api request in Network.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Wildbox contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- wildbox.ru
Wildbox sends data to wildbox.ru. No other extension we have analyzed sends data here.