Chrome Web StoreCaution required
Suspicious in code review (v30.13.26)
Our reviewer found behaviour consistent with malware in version 30.13.26, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
What our analysis found
Fiktu EC Hub | Fatkun is rated caution by Extension Auditor. Our code review reported 5 findings (1 critical, 3 high, 1 medium), led by network interception. It comes from a trusted publisher and was last updated in October 2026.
Key findings
- Critical
Network Interception
A declarativeNetRequest rule unconditionally strips Content-Security-Policy and X-Frame-Options response headers from every main frame and subframe the browser loads — not just the e-commerce sites the extension targets. This globally removes the browser's primary XSS and clickjacking defenses across the user's entire browsing session. A separate rule (id 5) also strips CSP specifically for [domain withheld] and [domain withheld]. This is far beyond the scope needed to embed product images from partner platforms.
- High
Remote Code Loading
On install and startup the extension fetches a version manifest from [domain withheld], then downloads and immediately applies updated copies of,,,, and as live declarativeNetRequest session rules. The [domain withheld] operator can silently push new header-stripping or request-redirect rules at any time without a Chrome Web Store update or any user notification, providing a persistent remote rule-injection pathway that bypasses store review.
- High
Network Interception
This content script runs at document_start in the MAIN JavaScript world on all URLs, monkey-patching window.fetch and XMLHttpRequest globally on every page the browser visits. On Facebook it silently extracts the fb_dtsg CSRF token from page DOM and intercepted GraphQL responses, then uses it to make authenticated API calls on the user's behalf. While the token was not observed being transmitted to [domain withheld] in the analyzed code, this infrastructure — a persistent CSRF token extractor running on every page including banking and sensitive sites — creates significant risk well beyond the extension's image-download purpose.
- High
Privilege Escalation
When the extension detects a development (sideloaded) install type it downloads a ZIP package from [domain withheld] and instructs the native helper process com.fatkun.dl_helper to install it, completely bypassing Chrome Web Store review and Google's malware scanning pipeline. This creates an out-of-band update channel that could silently ship capabilities not reviewable by the store; combined with the remote config pipeline this provides two independent pathways for the operator to alter extension behavior post-install.
- Medium
Other
On install and startup (gated on Chinese locale detection), the extension fetches a server-controlled list from [domain withheld] and creates or updates Chrome bookmark entries accordingly. The operator can inject arbitrary URLs and titles into the user's bookmark bar without explicit per-bookmark consent, a capability that could be repurposed for phishing link injection or traffic steering.
Analyst notes
Fatkun EC Hub is a legitimate e-commerce image-sourcing tool (publisher has 17 extensions with 0 malicious, Google Trusted Publisher badge, ML score 0.08 which is low-end medium) but contains several design decisions creating genuine security risks: a blanket declarativeNetRequest rule strips CSP and X-Frame-Options on every page the browser loads; a remote config pipeline pushes updated network-interception rules from [domain withheld] without CWS review; and a MAIN-world content script monkey-patches window.fetch and XMLHttpRequest globally, capturing Facebook fb_dtsg CSRF tokens on every Facebook page load. The third-party risk score's high impact rating is corroborated by these behaviors; however the ML score of 0.08 and the clean publisher reputation contradict a malicious verdict — the patterns are aggressive but consistent with a known Chinese browser-extension developer tooling aggressively for cross-platform e-commerce scraping.
Fiktu EC Hub | Fatkun Chrome extension security report
ID: hmgibpjifgjbjjapgcjhpcnpflbodemg
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- fatkunimage@gmail.com
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Screenshots & videos
Install growth
No Security Analysis Available
Security analysis has not been performed for this extension version yet.
About this extension
E-commerce toolkit: batch download product images from 1688, Taobao & more. AI tools, profit calculator, sourcing hub.
Read the publisher’s full description
Futoo EC Hub — The ultimate new tab dashboard built for e-commerce sellers and cross-border traders. Transform your browser into a powerful sourcing command center. Whether you're finding products on 1688, managing listings on Amazon, or sourcing from AliExpress — Futoo EC Hub puts everything you need at your fingertips. 🚀 EC DASHBOARD Your new tab becomes an intelligent e-commerce workspace. Quick access to 40+ e-commerce platforms, real-time exchange rates, profit calculator, event calendar, daily news feed, and more — all in one beautiful dashboard. 📸 BATCH PRODUCT IMAGE DOWNLOAD Automatically detect and group product images from e-commerce platforms. Separate main images, SKU/color variants, and detail/description images. One-click download entire product listings. 🔎 REVERSE IMAGE SEARCH Upload any product photo to find matching suppliers on 1688. Built-in side panel for seamless sourcing workflow — search by image without leaving your current page. 💰 PROFIT CALCULATOR Calculate margins instantly with built-in platform fee presets for Amazon (15%), Shopee (5.5%), eBay (13%), AliExpress (8%), Etsy (6.5%), and more. Supports multi-currency cost/selling price input with automatic conversion. 💱 REAL-TIME EXCHANGE RATES Live CNY exchange rates for 12+ currencies (USD, EUR, GBP, JPY, KRW, THB, VND, etc.). Built-in currency converter for quick calculations. 📅 E-COMMERCE CALENDAR Never miss a sales event! Track 618, Singles' Day (11.11), Black Friday, Prime Day, Cyber Monday, 12.12, and more with countdown badges. 🧰 FATKUN TOOLBOX • AI Background Removal — Remove product backgrounds instantly • AI Image Translation — Translate text in product images • Smart Crop — AI-powered product image cropping • Virtual Try-On — AI model studio for clothing/shoes • Video Translation & Subtitle Removal • Batch image format conversion and renaming • Image stitching for listing optimization 🏭 1688 SOURCING TOOLS • Hot product rankings and trend analysis • Store-level product collection • Bulk Excel export for product data • Price monitoring and alerts 📰 DAILY E-COMMERCE NEWS Stay updated with curated industry news from 36Kr, Ebrun, and more — directly on your new tab. 💡 MORE FEATURES • Quick Access shortcuts for your most-used tools • Recently viewed products with browsing history • Sourcing ideas based on your search patterns • Memo pad for quick notes and task tracking • Command Palette (Ctrl+K) for instant actions • Zen Mode with breathing exercises for work-life balance • Beautiful Bing wallpapers with auto-rotation • Widget visibility and layout customization • Blur mode (Esc key) for privacy protection • 15+ language support ⬇️ POWERFUL IMAGE DOWNLOADER All the core Fatkun image downloading features are included: • Batch download from any website • Smart drag-to-select multiple images • Filter by size, type, and keywords • AI-powered smart collection rules • Pinterest, Instagram, Facebook support • Dark mode 🔒 PRIVACY Futoo EC Hub respects your privacy. We don't collect personal data or browsing history. All processing happens locally in your browser. 📧 SUPPORT Have questions or suggestions? Contact us at fatkunimage@gmail.com
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
No network indicators were extracted from this version.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from fatkunimage@gmail.com
- Fatkun Image Search30,000 users
- Fatkun Image Editor10,000 users
- Downloader for Instagram™ - Photos & Videos1,000 users
- Facebook Downloader - Photos & Videos493 users
- Pinterest Image Downloader | Futoo384 users
Popular in productivity/tools
- Claude19,000,000 users
- Torrent Scanner8,000,000 users
- ChatGPT7,000,000 users
- Video Download Helper6,000,000 users
- Sider: Chat with all AI: GPT-5, Claude, DeepSeek, Gemini, Grok5,000,000 users