| 1 | Network Interception | critical | background.bundle.js (line 1) | On startup the extension fetches netRules.json from a remote AWS S3 server and immediately applies the rules as Chrome declarativeNetRequest session rules, giving the remote server operator real-time control over whic… | |
| 2 | Remote Code Loading | critical | scriptMain.bundle.js (line 1) | The extension fetches remotely-hosted JavaScript (scriptText and prejsText) from an AWS S3 bucket via the CMD_GET_SCRIPT background command, then injects it directly into the current page's DOM by setting a script ele… | |
| 3 | Remote Code Loading | critical | background.bundle.js (line 1) | When a content script requests a site-specific script via CMD_GET_SCRIPT, the background fetches the full JavaScript text from a remote URL (either the S3 CDN or a locally cached copy) and returns it to the caller. Co… | |
| 4 | Remote Code Loading | critical | background.bundle.js (line 366) | The extension downloads executable script bodies and pre-scripts from remote URLs at runtime instead of relying only on packaged code. Because these scripts are later injected into web pages matched by the extension, … | |
| 5 | Credential Theft | high | aiscripts3/ec.bundle.js (line 26697) | This code extracts `pdd_user_id`, `PDDAccessToken`, and `VerifyAuthToken` from page cookies/localStorage and reuses them in privileged requests. Harvesting live authentication tokens from the browsing context is a str… | |
| 6 | Network Interception | high | js/fetch.hook.js (line 1) | This script globally monkey-patches the window.fetch function by replacing it with an interceptor that clones every response and parses it as JSON before allowing the original promise to resolve. While it currently on… | |
| 7 | Network Interception | high | netRules.json (line 1) | The extension installs a blanket rule that strips `Content-Security-Policy` and `X-Frame-Options` from all main-frame and sub-frame responses. Removing these browser-enforced protections weakens site isolation and mak… | |
| 8 | Other | high | js/background.js (line 2) | The background script loads jdRules (JD.com/Taobao redirect rules) from chrome.storage, then monitors all tab updates for URLs matching obfuscated Taobao/Baidu affiliate click patterns. When a match is detected it sil… | |
| 9 | Remote Code Loading | high | ct.bundle.js (line 1) | The content script hardcodes a second AWS S3 bucket URL (fkpm3.s3.ap-northeast-2.amazonaws.com) and updates the extension's assetsServer storage key to point to it 30 days after installation, then injects sm.bundle.js… | |
| 10 | Unauthorized Data Collection | high | aiscripts3/ads.bundle.js (line 1) | When running on Baidu search pages (www.baidu.com), this script injects an unsolicited iframe advertisement from ad.aginnov.com into the page's right sidebar, completely outside user awareness or consent. It also gene… | |
| 11 | Unauthorized Data Collection | high | aiscripts3/fbpre.bundle.js (line 1) | This script completely replaces XMLHttpRequest's open and send prototype methods, intercepting every XHR response on the page. It specifically targets Facebook GraphQL API responses containing pageItems.edges (Faceboo… | |
| 12 | Unauthorized Data Collection | high | aiscripts2/www.facebook.com.js (line 111) | The Facebook-specific script reads the `c_user` cookie directly from `document.cookie` and then performs authenticated GraphQL requests against Facebook. Pulling session-linked identifiers from cookies to drive hidden… | |
| 13 | Unauthorized Data Collection | high | aiscripts3/ads.bundle.js (line 13747) | This ad module sends the user's current search query to an external `aginnov.com` endpoint that looks unrelated to the core image-downloading function. Forwarding live search terms to a third party for ad/chat process… | |
| 14 | Obfuscation | medium | js/background.js (line 2) | When a tab navigates to any Taobao or Baidu affiliate-click URL (matched against the reverse-obfuscated regex), the extension immediately injects CSS that sets body display:none, rendering the page invisible to the us… | |
| 15 | Privilege Escalation | medium | manifest.json (line 1) | The manifest declares all extension files (/* glob) as web-accessible from any origin (<all_urls>), meaning any web page can load any internal extension file including bundle scripts and internal assets via chrome-ext… | |
| 16 | Tracking | medium | background.bundle.js (line 64) | The background worker creates a persistent UUID and transmits it together with extension events to Google Analytics. This is a tracking mechanism tied to a stable user identifier, which is noteworthy given the extensi… | |
