Security Warning: High Security Risk
Lisstify
ID: gblekkmmmgnmafpdckoapgbcmoiageln
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- MADQUICK DIGITAL AGENCY PRIVATE LIMITEDView Profile
- Privacy
- Privacy Policy
- Help
- Help Center
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- Yes
- Mailbox exists
- Yes
Save & autofill product listing templates on Meesho Supplier Panel. Add catalogs faster.
Lisstify is a smart autofill extension built specifically for Meesho suppliers. Save your product listing templates once and autofill them instantly — add catalogs to Meesho Supplier Panel in a fraction of the time. WHY LISSTIFY? Meesho suppliers know the pain — filling out the same product details, descriptions, sizes, prices, and specifications over and over for every catalog. Lisstify eliminates that repetitive work completely. KEY FEATURES - Save product listing templates for Meesho catalogs - Autofill product forms on Meesho Supplier Panel instantly - Add multiple catalogs without retyping the same details - Works directly inside the Meesho Supplier Panel - Free plan available with Pro plan for heavy sellers WHO IS IT FOR? - Meesho suppliers managing large catalogs - Resellers adding new products frequently - Suppliers with repeated product types (e.g. same size sets, same specs) - Anyone looking to scale their Meesho store faster GET STARTED Install Lisstify → Open Meesho Supplier Panel → Save your first template → Autofill any listing in one click. Start listing faster today!
The bundled manifest declares 7 permissions (including unlimitedStorage and declarativeNetRequest) plus 8 host_permissions covering two major e-commerce supplier panels, two localhost dev URLs, a legacy backend URL, and a third-party image domain. The live CWS listing's published manifest shows only 5 permissions and a single host (https://lisstify.com/*). Users who review permissions before installation are shown a dramatically reduced footprint compared to what the installed extension actually requests. The declarativeNetRequest permission is paired with an empty rules.json, suggesting it was added speculatively or for future use without disclosure.
{ "permissions": [ "activeTab", "scripting", "storage", "unlimitedStorage", "tabs", "windows", "declarativeNetRequest" ], "host_permissions": [ "https://listify-backend-q3md.onrender.com/*", "https://lisstify.com/*", "http://localhost:4009/*", "http://localhost:3000/*", "*://seller.flipkart.com/*", "*://*.flixcart.com/*", "*://supplier.meesho.com/*", "https://messho-images.picckie.com/*" ]}The extension injects itself into the Meesho supplier panel's MAIN world (bypassing CSP) and monkey-patches both `window.fetch` and `XMLHttpRequest.prototype` to silently intercept Meesho's internal `getTransferPrice` API responses. The captured shipping-cost data is then persisted to the publisher's backend via the `save_shipping_costs` message handler. While the stated purpose (finding the product image with the lowest shipping fee) is aligned with the extension's autofill mission, patching native browser network APIs on a third-party site to capture its internal API responses — without any explicit in-UI disclosure of the interception — is an aggressive technique. The data exfiltrated to lisstify.com (image URL → shipping charge mappings) belongs to Meesho's pricing system and is obtained without Meesho's consent.
if (msg.action === "inject_transfer_interceptor") { const tabId = _sender?.tab?.id; ... chrome.scripting.executeScript({ target: { tabId }, world: "MAIN", func: function() { ... var _origFetch = window.fetch; window.fetch = async function() { var res = await _origFetch.apply(this, args); if (url.includes("getTransferPrice")) { res.clone().json().then(function(d) { window.postMessage({ __listify: "transferPrice", data: d }, "*"); }); } return res; }; XMLHttpRequest.prototype.open = function(method, url) { this.__listifyUrl = url || "";... }; XMLHttpRequest.prototype.send = function() { if (self.__listifyUrl && self.__listifyUrl.includes("getTransferPrice")) { self.addEventListener("load", function() { var d = JSON.parse(self.responseText); window.postMessage({ __listify: "transferPrice", data: d }, "*"); }); } }; }, })By severity
Versions scanned
Showing 1 of 20 scanned versions with more than one unique finding. Counts are unique findings that include each version.
| Extension Version | Code Review Findings |
|---|---|
| 1.3.5 | 2 |
Files with findings
2 distinct paths — top paths by unique finding count:
- background.js1
- manifest.json1
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
Gain full insight into all external connections.
Upgrade for full visibility.
Gain full insight into all external connections.
Upgrade for full visibility.
Code Diff
Compare extension code between any two versions.
No comparable text files found between these versions.
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.