Chrome Web StoreCaution required
Suspicious in code review (v2.0.3)
Our reviewer found behaviour consistent with malware in version 2.0.3, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
177 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
芒果店长, used by 20,000 people, is rated caution by Extension Auditor. Our code review reported 3 findings (2 high, 1 medium), led by remote code loading. Its permissions mean it can inject scripts into pages and can observe network requests.
Key findings
- High
Remote Code Loading
On every page load the content script calls [domain withheld]> and, if the server returns a 'detect' field, immediately sends it to via the 'execute' message. then injects the h() function into the tab (chrome.scripting.executeScript) which calls new eval5.Function(detect)(...) to run the server-supplied code in the page's content-script scope. Because the server controls what code is delivered, this is effectively remote code execution on every e-commerce page the user visits — benign today but trivially weaponisable.
- High
Remote Code Loading
The h() helper is injected into every target tab via chrome.scripting.executeScript and evaluates server-provided strings using eval5.Function. The three dispatch modes (localhref, element, url) all evaluate code strings retrieved from [domain withheld]; the function is passed the live jQuery $ object, giving it DOM read/write access. This is the runtime half of the remote-code-loading architecture: even though eval5 is an interpreter rather than native eval, it can still manipulate the page DOM and read page-resident data.
- Medium
Other
The bundled manifest grants externally_connectable messaging rights and web_accessible_resources exposure to five additional origins (MercadoLibre country variants, TikTok) beyond the single *://*.[domain withheld] shown in the published CWS manifest. It also adds host_permissions for [domain withheld] (HTTP and HTTPS) and [domain withheld] that do not appear in the published listing. Undisclosed permissions expand the extension's attack surface — any MercadoLibre or TikTok page can now send messages to the extension's runtime without the user knowing this connection is possible.
Analyst notes
The extension's declared purpose — a cross-border e-commerce seller ERP tool for scraping product listings and automating orders across Taobao, Tmall, 1688, Shopee, Lazada, Amazon, eBay, Temu, and others — is fully borne out by the code: all network calls target [domain withheld] (first-party) or the specific supported platforms, and the permhash cluster has malicious peers. However, two structural concerns prevent a clean clearance: (1) the extension fetches arbitrary JavaScript function bodies from [domain withheld] and executes them via eval5.Function in content-script scope on every page the user visits, giving the server live code-execution capability over user pages — a capability operated by a publisher whose other extensions are marked malicious; (2) the bundled manifest grants broader permissions (additional host_permissions for [domain withheld] and tiktok HTTP, and additional matches for MercadoLibre and TikTok) beyond what the published CWS manifest declares. The ML score (0.10), clean permhash cluster, and listing alignment all point toward benign use, but the publisher reputation combined with a server-controlled code injection architecture warrants a suspicious rating rather than a clearance.
芒果店长 Chrome extension security report
ID: imjfokfjjgpijjfgnodojafbkoonmmkh
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- 富通天下云技术团队
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- Yes
- Is role-based
- No
- Mailbox exists
- Yes
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
Sensitive Domain Access
This extension has access to the following sensitive domains:
- http://www.ebay.com/
- https://www.ebay.com/
- http://*.ebaydesc.com/
- http://www.amazon.com/
- https://www.amazon.com/
177 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
芒果店长产品采集插件，支持单品和分类采集。
Read the publisher’s full description
芒果店长（http://www.mangoerp.com/）产品采集工具，支持单品采集和分类采集。采集后可发布到多平台多店铺。
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
177 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
Popular in Workflow & Planning
- Adobe Acrobat: PDF edit, convert, sign tools345,000,000 users
- Application Launcher For Drive (by Google)99,000,000 users
- AdBlock — block ads across the web64,000,000 users
- Chrome Remote Desktop41,000,000 users
- Adblock Plus - free ad blocker40,000,000 users