Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 巧巧郎的鑰匙

CRITICAL RISKRemoved from Chrome Web Store

巧巧郎的鑰匙

ID: lacejchmbljdoaimkbmcflcechgndbim

Could be malicious

Supported Languages

🇹🇼Chinese (Traditional)

Extension Info & Metadata

Status

Removed

Version

2.1.4

Size

1.76 MB

Rating

5.0/5

Reviews

129

Users

10,000

Type

Extension

Updated

Oct 20, 2024

Publisher Contextual Analysis

Author: https://www.kkren.com.twView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

讓您輕松把淘寶阿里巴巴購買的包裹放入巧巧郎，免除繁瑣勞累的登記包裹步驟

巧巧郎的鑰匙讓您輕鬆把淘寶阿里巴巴購買的包裹放入巧巧郎，免除繁瑣勞累的登記包裹步驟

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

No change in user count

Compared to 4 months ago

7 versions released in this period

Rating Count

Total: 9 ratings

Average Rating

Current: 5.00 / 5.0+5.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical1

High6

Medium2

Low1

Versions scanned

Showing 1 of 44 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
2.0.1 Code review	10

Extension Version	Code Review Findings
2.0.1	10

Files with findings

7 distinct paths — top paths by unique finding count:

assets/background.ts-DfM8Cohd.js4
assets/installStatus.ts-0taGwe7e.js1
assets/shopeeCollect.ts-B4XcJzAZ.js1
static/inject/addJyAddress.js1
static/inject/fetchHook.js1
static/inject/fetchWindowVar.js1
static/inject/tbApi.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	critical	assets/background.ts-DfM8Cohd.js (line 15937)	The extension exposes an `axiosRequest` external command that accepts arbitrary HTTP request configuration from any page on kkren.com.tw or localhost (declared in `externally_connectable`) and performs the request via…	2.0.1
2	Credential Theft	high	static/inject/tbApi.js (line 29)	Reads the Taobao session cookie `_m_h5_tk` from `document.cookie`, signs MTOP API requests with it, and dynamically builds and injects a `<script>` element into the page (`runPageScripts`) that defines a JSONP callbac…	2.0.1
3	Data Exfiltration	high	assets/shopeeCollect.ts-B4XcJzAZ.js (line 6)	Pairs the fetch-hook above with code that scrapes Shopee shop responses and forwards seller-private fields (company name, company ID number, last login time, seller metrics, cancellation rate, etc.) to the background …	2.0.1
4	Data Exfiltration	high	assets/background.ts-DfM8Cohd.js (line 15961)	Receives the scraped Shopee shop data and POSTs it to `apisp.jyb.com.tw/sed/eshop/add` along with the user's `kkrenToken`. Confirms the exfiltration endpoint and that the data leaves the device unprompted whenever the…	2.0.1
5	Network Interception	high	static/inject/fetchHook.js (line 17)	Monkey-patches `window.fetch` to clone and read the body of every response returned to the page, then re-broadcasts the URL, status and full response body via `window.postMessage('*')` so any listener (including the c…	2.0.1
6	Privilege Escalation	high	static/inject/addJyAddress.js (line 4)	Programmatically lists, deletes, and inserts entries in the user's Taobao delivery-address book by calling MTOP APIs in their authenticated session. The deletion logic also removes arbitrary addresses (any of the user…	2.0.1
7	Unauthorized Data Collection	high	assets/background.ts-DfM8Cohd.js (line 15941)	The `management` permission is used to enumerate every extension installed in the user's browser, and the resulting list is returned to an external page (kkren.com.tw / localhost) on demand. Exposing the full installe…	2.0.1
8	Tracking	medium	assets/background.ts-DfM8Cohd.js (line 34)	Sends usage telemetry (view list, click goods, etc.) to Google Analytics Measurement Protocol with a hard-coded `api_secret` (`K3lkME_PRv6OBGk5HMoQBg`) and a per-install random `client_id` persisted to `chrome.storage…	2.0.1
9	Unauthorized Data Collection	medium	static/inject/fetchWindowVar.js (line 1)	Generic primitive that reads any global variable from the page's main-world JavaScript context by name and posts its value back. Used by `fetchGoods.ts` to read `__INIT_DATA` / `g_config` from Taobao/1688/Tmall produc…	2.0.1
10	Tracking	low	assets/installStatus.ts-0taGwe7e.js (line 1)	Injects a hidden `<div>` containing the extension's runtime ID and version at `document_start` on every kkren.com.tw / localhost page so the page can detect that the extension is installed and which version. Used in c…	2.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.kkren.com.tw	-	https://www.kkren.com.tw/
static.kkren.com.tw	/static/images/logo_text.png	https://static.kkren.com.tw/static/images/logo_text.png
api.jyb.com.tw	/tpsp/v1frontend/tptt-item/search-taobao	https://api.jyb.com.tw/tpsp/v1frontend/tptt-item/search-taobao
api.jyb.com.tw	/tpsp/v1frontend/tptt-item/view-taobao	https://api.jyb.com.tw/tpsp/v1frontend/tptt-item/view-taobao?accessToken=${encodeURIComponent(b
vuejs.org	/error-reference/	https://vuejs.org/error-reference/#runtime-${n}`;for(;i;
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
wuliu.1688.com	/foundation/ajax/operate_receive_address.jsx	https://wuliu.1688.com/foundation/ajax/operate_receive_address.jsx?_input_charset=UTF-8
feross.org	/opensource	https://feross.org/opensource

Showing 1 to 10 of 90 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


237.138.146.38	IPv4	-

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

辛苦半夜還在幫我解答

吳

吳欣怡·7 Jan 2025

處理快速

ryan yu·6 Jan 2025

有幫助到.很棒

穎

穎吉達·4 Jan 2025

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

巧巧郎的鑰匙

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 44 Versions10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating