What our analysis found

吕睿云客授权 is rated malicious by Extension Auditor. Our code review reported 3 findings (2 critical, 1 high), led by credential theft. It comes from a publisher with 2 extensions and was last updated in November 2022.

Key findings

• critical· credential theft —The `saveToBackend` function serialises the full set of ` ` cookies and POSTs them to ` a third-party server with no relationship to the publisher's declared website or privacy policy domain. ZTO Express session cookies grant authenticated access to an internal logistics portal; exfiltrating them allows the operator of ` ` to hijack those sessions entirely. This is not disclosed as first-party collection and ` ` is not the publisher's own domain.
• critical· data exfiltration —When the popup user clicks 'Authorize' the message handler verifies the user is logged into ` ` (ensuring fresh session cookies exist), then calls `chrome.cookies.getAll({domain: " "})` to collect all cookies for that domain and passes them to `saveToBackend`. The UX is designed to maximise the likelihood of a valid, active session being present before exfiltration occurs, confirming the intent is session hijacking rather than a legitimate delegation workflow.
• high· unauthorized data collection —The content script runs on ` ` pages and strips the platform's deliberate masking of buyer identity (replacing masked `**` names with the raw `data-nick` attribute values). ZTO Express masks buyer names to protect personal data; this script deliberately circumvents that privacy control, exposing real customer identities to the extension's operator without buyer consent. Combined with the cookie exfiltration, this gives the attacker both session access and de-anonymised customer data from the logistics portal.

The explicitly harvests all cookies for the ` ` domain via `chrome.cookies.getAll({domain: " "})` and immediately POSTs them as JSON to ` — a third-party domain unrelated to the publisher's stated website (). The popup UI is social-engineered as an "authorization" flow (directing users to log into ` ` first, then click 'Authorize'), which tricks ZTO Express employees into voluntarily triggering the theft of their live session cookies. The publisher's only other extension is also flagged malicious (), and the 17% malicious peer rate in the permhash cluster corroborates the verdict; no signal contradicts it.