Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 鲸麦GemX.ai

CRITICAL RISKRemoved from Chrome Web Store

鲸麦GemX.ai

ID: imnahfoohpfdehdnmbljdlgcplkiehjo

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

1.4.8

Size

0.94 MB

Rating

4.8/5

Reviews

Users

4,319

Type

Extension

Updated

Dec 1, 2023

Publisher Contextual Analysis

Author: https://merlinks.comView Profile
Privacy: Privacy Policy
Country: CN
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 海基六路 218弄24号3楼浦东新区, 上海市 201308 CN
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

4,319

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

鲸麦GemX.ai基于大数据和人工智能技术，对亚马逊市场变化和卖家运营数据进行持续的深度分析，帮助卖家一站式大数据选品、产品开发和精细化运营。

结合鲸麦特有的亚马逊选品模型，通过趋势追踪、产品透视、市场洞察、竞品分析等四大板块，帮助卖家抓住市场机会，快速做出选品判断。

User Growth

Showing data from Jun 08, 2022 to Jun 07, 2023

Versions

-20.82%(-1,136 users)

Compared to 4 months ago

37 versions released in this period

Rating Count

Total: 16 ratings

Average Rating

Current: 4.81 / 5.0+4.81

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High4

Medium2

Low0

Versions scanned

Showing 1 of 51 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.4.7 Code review	8

Extension Version	Code Review Findings
1.4.7	8

Files with findings

3 distinct paths — top paths by unique finding count:

js/content.js4
background.js3
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Unauthorized Data Collection	critical	background.js (line 257)	The background service worker exposes a comprehensive Amazon data-harvesting API to any external website listed in `externally_connectable`. Any page at merlinks.com, genmatrix.cn, or gemx.ai can invoke this listener …	1.4.7
2	Unauthorized Data Collection	critical	background.js (line 236)	The `getSellerInfo` function accepts a fully caller-controlled `url` parameter from external origins via `onMessageExternal` (kind=7). It fetches that URL with the user's Amazon session cookies and returns the full HT…	1.4.7
3	Credential Theft	high	js/content.js (line 4115)	The content script renders a login form on Amazon pages that collects the user's platform username (`principal`) and password (`credentials`) and POSTs them directly to `https://ext.genmatrix.cn/login`. The returned J…	1.4.7
4	Data Exfiltration	high	js/content.js (line 3980)	An Axios instance is configured to send every request to `https://ext.genmatrix.cn/` with the user's `gmToken` JWT automatically attached as a bearer Authorization header. This instance is used throughout the content …	1.4.7
5	Privilege Escalation	high	manifest.json (line 57)	The `externally_connectable` declaration grants all subdomains of three developer-controlled commercial domains (merlinks.com, genmatrix.cn, gemx.ai) direct message-passing access to the extension background page. It …	1.4.7
6	Unauthorized Data Collection	high	background.js (line 128)	Review content, reviewer names, profile links, avatar URLs, and home page URLs are scraped from Amazon using the user's authenticated session (`credentials: 'same-origin'`). The raw HTML is returned verbatim to whiche…	1.4.7
7	Code Injection	medium	js/content.js (line 11376)	The content script dynamically appends `inject.js` into the Amazon page's DOM on every `readystatechange` event by creating a `<script>` element. While `inject.js` is currently a near-empty stub, this injection mechan…	1.4.7
8	Data Exfiltration	medium	js/content.js (line 4024)	A second Axios instance targets `https://ext.merlinks.com/`, a separate developer-controlled domain. Data is sent to two distinct backend endpoints (genmatrix.cn and merlinks.com), suggesting a split-backend architect…	1.4.7

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

118

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
sellercentral.amazon.com	/analytics/data/dashboard/searchTerms/report/searchTermsDetail	https://sellercentral.amazon.com/analytics/data/dashboard/searchTerms/report/searchTermsDetail?*
www.amazon.com	/s/query*	https://www.amazon.com/s/query*
www.amazon.com	//nextPage	https://www.amazon.com//nextPage
www.amazon.com	/gp/twister/ajaxv2*	https://www.amazon.com/gp/twister/ajaxv2*
https:	-	https://www.amazon.${AREA_CODE[area
www.amazon.com	/s	https://www.amazon.com/s?k=${kw}&page=${page}&ref=sr_pg_${page}`,
www.amazon.com	/gp/$%7Bt	https://www.amazon.com/gp/${t

Showing 1 to 10 of 120 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

做亚马逊运营的必备，点赞

Molly Carey·18 Jul 2023

开发产品必备插件

Anonymous·22 Mar 2023

产品开发非常nice，天��用，爽��提高工作效率。

温

温��良·22 Mar 2023

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

鲸麦GemX.ai

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 51 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating