| 1 | Code Injection | critical | js/popup.js (line 1) | The _formatData method passes a raw server response string directly to eval() to parse it as data. If the server at the referenced endpoint is ever compromised or if network responses are intercepted (requests use pla… | |
| 2 | Credential Theft | critical | components/haitaoUtils/index.js (line 1) | setLoginInfo() uses chrome.cookies.getAll() to harvest sensitive Taobao/eTao session cookies: _tb_token_ (CSRF/session token), tracknick (username), a_nk, _nk_ (encrypted nickname), unb (numeric user ID), and l_t (log… | |
| 3 | Credential Theft | critical | components/haitaoAddressNewDialog/index.js (line 1) | When the user saves a forwarding address, the extension transmits first name, last name, apartment, company ID, and the Taobao session authentication token (_tb_token_) to http://haiwai.etao.com/ajax/transfer_user_inf… | |
| 4 | Credential Theft | critical | components/haitaoAddressEditDialog/index.js (line 1) | The address edit flow also POSTs the user's Taobao _tb_token_ alongside personal address fields to the same etao.com endpoint over HTTP. This is a systematic pattern — every address save operation (new or edit) transm… | |
| 5 | Code Injection | high | js/seed-components.js (line 8) | The KISSY template engine compiles template strings into executable functions using new Function() inside a with() block. This is functionally equivalent to eval() — if any server-returned data reaches the template co… | |
| 6 | Credential Theft | high | components/haitaoUtils/index.js (line 1) | statistics() reads the 'cna' cookie from .mmstat.com (Alibaba's analytics domain) using chrome.cookies.getAll(), then embeds it in tracking beacons sent to etao.com analytics. The 'cna' cookie is a persistent cross-si… | |
| 7 | Credential Theft | high | js/login.js (line 1) | login.js registers a separate chrome.cookies.onChanged listener monitoring login, tracknick, a_nk, and _nk_ cookies for etao.com — duplicating the surveillance in haitaoUtils. Every change to these session cookies is … | |
| 8 | Data Exfiltration | high | components/haitaoUtils/index.js (line 1) | Every word captured by hoverGetWord is transmitted to the Youdao translation API (fanyi.youdao.com) using a hardcoded operator API key (10220261624kr1O8kVtB). This API key belongs to the extension operator, enabling s… | |
| 9 | Data Exfiltration | high | components/haitaoTrackAjax/index.js (line 2) | Users' international package tracking numbers are transmitted to four external third-party logistics APIs (youjiaus.net, 360banma.com, 4px.com, buytong.com) using hardcoded API tokens — all over plain HTTP. These are … | |
| 10 | Data Exfiltration | high | components/haitaoTrackAjax/index.js (line 2) | Both domestic and international shipment tracking numbers are sent to api1.hai0.com using a hardcoded API key (G00TBPg9aKAAjXZtfFeA). hai0.com is a third-party Chinese logistics aggregator entirely outside Alibaba's e… | |
| 11 | Data Exfiltration | high | components/haitaoUtils/index.js (line 1) | bindSubmitFunction() intercepts order placement clicks on Amazon and other shopping sites. It scrapes the purchase price from the page DOM and beacons it — along with the persistent cna tracking ID, site domain, and A… | |
| 12 | Phishing | high | js/login.js (line 1) | The extension injects an iframe embedding a live Taobao login form (login.taobao.com) directly into whatever page the user is currently visiting. This overlays a real authentication form from Taobao onto arbitrary thi… | |
| 13 | Privilege Escalation | high | background.js (line 2) | The background message router exposes 'getLoginStatus' which returns the raw localStorage.haitao_login blob (containing Taobao session tokens, _tb_token_, user ID) to any content script that requests it. The 'setLocal… | |
| 14 | Remote Code Loading | high | components/notification/index.js (line 1) | pushNotify() polls an etao.com API every 5 minutes (300,000ms) and creates desktop browser notifications whose title, body, image, and click-destination URL are all fully server-controlled. On click, chrome.tabs.creat… | |
| 15 | Remote Code Loading | high | components/notification/index.js (line 1) | websiteActivity() polls a second etao.com endpoint and creates a notification whose title (c.title), description (c.desc), image (c.image), and target URL (c.link) are all server-controlled. The notification open-URL … | |
| 16 | Remote Code Loading | high | js/seed.js (line 3) | The KISSY seed loader evaluates script tag data-config attributes using new Function('return ' + a)() — a direct eval equivalent allowing arbitrary code execution from DOM attributes. Additionally, the loader dynamica… | |
| 17 | Unauthorized Data Collection | high | components/haitaoUtils/index.js (line 1) | A persistent chrome.cookies.onChanged listener re-harvests all session tokens whenever the etao.com 'login' cookie changes. Additionally, every time the user switches tabs, the full set of harvested Taobao credentials… | |
| 18 | Unauthorized Data Collection | high | components/hoverGetWord/index.js (line 1) | On every mousemove event across every page the user visits, hoverGetWord captures the word under the cursor using getWordAtPoint() and after a debounce sends it to the background script with operate:'translate'. The b… | |
| 19 | Unauthorized Data Collection | high | components/haitaoGoodPrice/index.js (line 2) | The extension reads the Amazon product ASIN from every Amazon product page (via the hidden #ASIN DOM element) and reports it to Alibaba's haiwai.etao.com server. This allows Alibaba to build a detailed record of which… | |
| 20 | Unauthorized Data Collection | high | components/amazonFunction/index.js (line 1) | The extension scrapes the phone number from Amazon's checkout shipping address form (#purchase-shipping-address .displayAddressPhoneNumber) and compares it against hardcoded warehouse phone numbers. This demonstrates … | |
| 21 | Remote Code Loading | medium | components/haitaoUtils/index.js (line 1) | When the isLoadRemoteRes flag is enabled, loadExtraResource() constructs link elements whose href is assembled from server-controlled config values (a.extraUrl + resource path) and injects them into every page head. T… | |
| 22 | Tracking | medium | js/seed-components.js (line 2) | The Stat module sends page-view and click-event beacons to http://log.mmstat.com/search? (Alibaba analytics) via invisible pixel Image requests, including document.referrer on every page view. It also reads the 'pid' … | |
| 23 | Tracking | medium | components/amazonFunction/index.js (line 1) | The extension sends each viewed Amazon product's ASIN to camelcamelcamel.com (a third-party price tracker) by loading a tracking pixel. This allows camelcamelcamel.com to record the user's Amazon product browsing hist… | |
| 24 | Unauthorized Data Collection | medium | components/haitaoSidebarFeedback/index.js (line 1) | The feedback form silently reads the _nk_ cookie (Taobao encrypted username) via a.Cookie.get() and appends it as the 'nk' identifier in every feedback submission sent to Taobao's server. The current page's domain (do… | |
| 25 | Unauthorized Data Collection | medium | js/login.js (line 1) | The logout function injects a hidden zero-dimension iframe pointing to http://login.etao.com into whatever host page is currently active. This silently makes a cross-origin HTTP request from the user's browser to etao… | |
