What our analysis found

虾皮价格追踪器 is rated caution by Extension Auditor. Our code review reported 3 findings (1 critical, 2 high), led by other. Its permissions mean it can read and change data on all websites and can inject scripts into pages.

Key findings

• Critical

  Other

  The bundled manifest grants `<all_urls>` host permission and injects content scripts into every page the user visits (`[domain withheld], `[domain withheld], all_frames, match_about_blank). The published CWS manifest lists only 28 Shopee-specific domains in host_permissions and shows only Shopee domains in web_accessible_resources — a significant mismatch that conceals the extension's true access scope from the Chrome Web Store reviewer and users. This pattern of publishing a restricted manifest while shipping a broader one is a known technique to evade CWS review.

  Show more — Other
• High

  Network Interception

  The inject-script implements a `GET_HOST_REQUEST_HEADERS` message handler that permanently monkey-patches `XMLHttpRequest.prototype.setRequestHeader` and `XMLHttpRequest.prototype.open` on the host page. Once triggered, it intercepts all XHR requests site-wide: when a request URL matches any registered regex pattern, it captures the full set of HTTP request headers (stored in `this._headers`) — which can include `Authorization`, `Cookie`, and other session tokens — and posts them back via `globalThis.postMessage`. This runs in the main page world via an injected script, so it can intercept XHR calls made by the page itself, not just the extension.

  Show more — Network Interception
• High

  Unauthorized Data Collection

  The extension registers functions on `globalThis` to extract complete order data — including order IDs, SKU IDs, sub-order info, and product line items — from Taobao and AliExpress order history pages by reading directly from React internal fiber nodes. The publisher declares no data collection in the CWS listing ('none declared'), and the extension presents itself as a Shopee price tracker, making this undisclosed extraction of order data from unrelated platforms a concern. Whether these functions are automatically called or only on explicit user action cannot be determined without.

  Show more — Unauthorized Data Collection