Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 蝦皮黑名單輔助工具

CRITICAL RISKRemoved from Chrome Web Store

蝦皮黑名單輔助工具

ID: hljhpjmdableahlbikejdejlcicbkfem

Could be malicious

Supported Languages

🇹🇼Chinese (Traditional)

Extension Info & Metadata

Status

Removed

Version

2.6.8

Size

2.14 MB

Rating

3.7/5

Reviews

Users

9,000

Type

Extension

Updated

Nov 1, 2024

Publisher Contextual Analysis

Author: ERPowView Profile
Privacy: Privacy Policy
Country: TW
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Address: 文化路林口區, 新北市 244 TW
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

25,507

Email Change History

1 change

Feb 22, 2024

Domain changed

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

蝦皮黑名單輔助工具，能在訂單上顯示買家評價數量、未取及退貨次數，協助賣家瞭解更多訂單資訊

蝦皮黑名單工具能在訂單顯示買家評價、星星數及未取貨次數訂單顯示的評價、未取及退貨次數，能讓賣家評估是否要寄出商品未取次數過多及一星過多的高風險買家會以紅框提示另外，精心設計的「更新黑名單」能回傳賣家賣場裡未取訂單的用戶，加入黑名單大數據，讓未取記錄更精準賣家不需逐筆建立名單，浪費時間且直接從訂單裡抓取的記錄更客觀此軟體現在及未來都不會收費，請賣家們努力分享到社團，推薦給朋友免費軟體維持不易，5星好評就是給予我們最大的支持！大家一同回報未取訂單，讓資料庫準確，杜絕不良賣家，建立良好的網拍環境廣告合作以及瞭解更多詳情，請LINE ID 搜尋 @215kioly

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 4 months ago

1 version released in this period

Rating Count

Total: 15 ratings

Average Rating

Current: 4.47 / 5.0+0.13

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical2

High4

Medium1

Low1

Versions scanned

Showing 1 of 19 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.5.0 Code review	8

Extension Version	Code Review Findings
2.5.0	8

Files with findings

3 distinct paths — top paths by unique finding count:

content.bundle.js4
background.bundle.js2
js/update.bundle.js2

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	background.bundle.js (line 88)	On the 'set_user' message, the background script reads ALL cookies for the shopee.tw domain (including authenticated session cookies like SPC_EC/SPC_F/SPC_U), XOR-obfuscates the concatenated cookie string with the sel…	2.5.0
2	Data Exfiltration	critical	content.bundle.js (line 613)	Immediately on every seller.shopee.tw page load the content script fetches the seller's login info, then sends the 'set_user' message to the background script — which is the trigger for the cookie-exfiltration path ab…	2.5.0
3	Obfuscation	high	background.bundle.js (line 1)	The XOR-with-shop_id-then-base64 transformation in the cookie exfiltration path is named 'hashes' but is not a hash — it is reversible obfuscation designed to disguise the cookie payload from casual inspection of netw…	2.5.0
4	Tracking	high	content.bundle.js (line 470)	For every buyer username the seller views in their dashboard or chat, the extension queries the third-party server with that username in the URL. This leaks the seller's customer list and browsing patterns to blacklis…	2.5.0
5	Unauthorized Data Collection	high	content.bundle.js (line 89)	The extension paginates through the seller's full cancelled-order and return-order history from Shopee's internal APIs and uploads each buyer's PII (buyer_user_id, buyer_user_name, buyer_shop_id) along with order_id/o…	2.5.0
6	Unauthorized Data Collection	high	content.bundle.js (line 4)	Same exfiltration pattern as cancelled orders, but for return orders: buyer_user_id, buyer_user_name, buyer_shop_id, return_sn are uploaded to blacklist.shopee-ex.com/upload_return_order. The function chains via recur…	2.5.0
7	Remote Code Loading	medium	js/update.bundle.js (line 32)	The update flow asks blacklist.shopee-ex.com/get_blacklist for a URL (d.Url), then fetches that arbitrary URL, treats the response as a ZIP, and parses data.json from it. The download URL is fully attacker-controlled …	2.5.0
8	Data Exfiltration	low	js/update.bundle.js (line 113)	On any update error, the full error object is JSON-stringified and POSTed (along with shop_id) to blacklist.shopee-ex.com/add_log. Error objects can leak request URLs, response bodies, stack traces, and other state fr…	2.5.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

124

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/TR/xhtml1/DTD/xhtml1-transitional.dtd	http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
blacklist.spx-ex.com	-	https://blacklist.spx-ex.com
*.shopee.tw	/*	https://.shopee.tw/
seller.shopee.tw	/*	https://seller.shopee.tw/*
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
seller.shopee.tw	/api/v3/return/list	https://seller.shopee.tw/api/v3/return/list?SPC_CDS=${s.SPC_CDS}&SPC_CDS_VER=2`,method:
seller.shopee.tw	/api/v3/order/search_order_list_index	https://seller.shopee.tw/api/v3/order/search_order_list_index?SPC_CDS=${s.SPC_CDS}&SPC_CDS_VER=2`,method:
seller.shopee.tw	/api/v3/order/get_order_list_card_list	https://seller.shopee.tw/api/v3/order/get_order_list_card_list?
blacklist.spx-ex.com	/commercial_term	https://blacklist.spx-ex.com/commercial_term?guid=${r.guid}&shop_id=${r.shop_id}

Showing 1 to 10 of 130 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

看不到未取跟退貨次數

YUI C·7 Dec 2024

壞了嗎?一直卡在280這?

ALAN LIN·26 Nov 2024

懷疑是不是還有在維護，因為壞好久了都無法更新黑名單資料等同於裝了沒有任何意義

Kent Liu·23 Nov 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

蝦皮黑名單輔助工具

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Email Change History

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 19 Versions8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating