Is ZYing - Amazon/OZON/MercadoLibre More Info safe?

Medium risk

ZYing lets any page script ask Walmart's seller API to delete SKUs during an active seller session.

Its injected script listens for window postMessage events and does not check the sender's origin before handling deleteWalmartSku messages. On supported Walmart seller pages, that message triggers a DELETE request to seller.walmart.com/aurora/v1/items using the logged-in seller session and the SKU list in the message.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

杭州智赢科技有限公司v5.1.28Chrome Web Store
43Risk
Who publishes it

杭州智赢科技有限公司 - no other listings under this identity, 4 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
杭州智赢科技有限公司
Website
zying.net/

Shared hosts - 4 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

articulo.mercadolibre.cl
Also called by 2 other listings, including MercadoLibre Product Analytics and Store Operations Tool
articulo.mercadolibre.com.mx
Also called by 3 other listings, including MercadoLibre Product Analytics and Store Operations Tool
articulo.mercadolibre.com.co
Also called by 4 other listings, including MercadoLibre Product Analytics and Store Operations Tool
u-card.wb.ru
Also called by 4 other listings, including MP Manager - бесплатный анализ продаж конкурентов на Wildberries

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 5.1.25. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to. The current listed version is 5.1.28, which we have not unpacked yet.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Add items to the right-click menu

    contextMenus

declarativeNetRequestWithHostAccess

Where it sends data

Destinations our analysis observed ZYing contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • seller.walmart.com

    ZYing sends data to seller.walmart.com. 2 other extensions we have analyzed send data here.

Updated 2 November 2026pembniiibielncgmegepmgcbkieljieh