Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 帮您淘优惠

CRITICAL RISKRemoved from Chrome Web Store

帮您淘优惠

ID: hdnmdhiphkmokpjaabikmjkkapmbicej

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

1.3

Size

0.35 MB

Rating

1.0/5

Reviews

Users

2,978,454

Type

Extension

Updated

May 27, 2021

Publisher Contextual Analysis

Author: xiaochengxu1View Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

3,278,454

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

在淘宝天猫购物时，在商品详情页自动查询可领取的内部隐藏优惠券，领券后下单立减，可以更省钱

功能说明：帮您淘优惠是一款帮助用户快捷获取淘宝、天猫优惠券的浏览器插件。（1）您可通过点击插件图标呼出插件界面，在搜索框中输入想要查找的产品，按“回车”键后，可自动在帮您淘优惠的官网中搜索对应产品的优惠情况并领取优惠券。（2）当您在浏览淘宝、天猫商品时，插件会实时提醒您浏览的商品的优惠券情况，若该产品没有对应的优惠券会同步推荐给您相同款、相似款，帮您已最低价格购买到心仪商品。（3）您也可以通过点击插件界面下方的”立即查看“按钮跳转至帮您淘优惠官网，搜索更多优惠商品。

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High6

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.3 Code review	8

Extension Version	Code Review Findings
1.3	8

Files with findings

4 distinct paths — top paths by unique finding count:

static/js/tb.js4
static/js/popup.js2
manifest.json1
static/js/tb1.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Unauthorized Data Collection	critical	manifest.json (line 37)	The extension requests the `:///*` host permission, granting unrestricted access to all websites the user visits — far beyond the Taobao/Tmall pages where the content scripts actually run. This over-broad permission…	1.3
2	Tracking	high	static/js/tb.js (line 93)	The extension instruments virtually every user interaction—coupon clicks, product hover events, similar-item clicks, and activity banner clicks—with silent tracking beacons sent to sc.anhuiry.com. This constitutes com…	1.3
3	Tracking	high	static/js/tb.js (line 22)	The extension dynamically injects the Baidu Analytics script into every Taobao/Tmall product detail page visited by the user. This inserts a hidden third-party tracker (hm.baidu.com) directly into pages the user is br…	1.3
4	Tracking	high	static/js/tb1.js (line 51)	Same Baidu Analytics injection pattern as in tb.js, duplicated in the older tb1.js content script. The same tracking ID (f8eb3049f5f3b19f16dc85a83ca2922e) is used, confirming this is a deliberate, consistent strategy …	1.3
5	Unauthorized Data Collection	high	static/js/popup.js (line 51)	Every search query typed by the user in the extension popup is exfiltrated to a third-party tracking server (front.tools.sangzhua.com) before the user is redirected to the actual destination. This is done silently via…	1.3
6	Unauthorized Data Collection	high	static/js/tb.js (line 154)	On every Taobao/Tmall product page visit, the content script sends the product ID and a keyword derived from the page title to the external server sc.anhuiry.com. This silently reports the user's browsing activity (wh…	1.3
7	Unauthorized Data Collection	high	static/js/tb.js (line 38)	When users click on coupons or products, links are silently rewritten to route through the extension operator's affiliate redirect (bntyh.com with affiliate ID u=681200). Users believe they are clicking a direct produ…	1.3
8	Tracking	medium	static/js/popup.js (line 27)	A tracking beacon is fired to sc.anhuiry.com immediately every time the user opens the extension popup, even without any user action. This allows the operator to track how frequently users open the popup and correlate…	1.3

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
front.tools.sangzhua.com	-	https://front.tools.sangzhua.com/
sc.anhuiry.com	-	https://sc.anhuiry.com/
hm.baidu.com	-	https://hm.baidu.com/
s.click.taobao.com	/S2VAspu	https://s.click.taobao.com/S2VAspu
s.click.taobao.com	/LqUBspu	https://s.click.taobao.com/LqUBspu
www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.0 out of 5 · 3 most recent reviews

Text reviews

Positive

Negative

垃圾软件

杏

杏夏·25 Jul 2021

垃圾软件

�

��夏·25 Jul 2021

司马诱导安装，开发者你马死了

bob v·18 Jul 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

帮您淘优惠

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews