Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: 淘宝浏览器助手

CRITICAL RISKRemoved from Chrome Web Store

淘宝浏览器助手

ID: pojgaebihdbdbalcagioknbdkbdalgkp

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

2.0.4

Size

1.00 MB

Rating

2.0/5

Reviews

Users

10,000

Type

Extension

Updated

Aug 27, 2024

Publisher Contextual Analysis

Author: https://taobao.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

购物消息即时抢先看，大屏浏览一键丝滑购物，图片搜索快速找同款，精美壁纸自由随心切换，同款比价、购物返利加速升级中！

自定义您的浏览器的标签页，精美日历、炫酷天气、海量壁纸、常用网址随心订制。淘宝购物消息即时抢先看，图片搜索快速找同款。

User Growth

Showing data from Jul 16, 2024 to Sep 29, 2024

Versions

No change in user count

Compared to 3 months ago

6 versions released in this period

Rating Count

Total: 74 ratings+7 (10%)

Average Rating

Current: 2.01 / 5.0+2.01

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High3

Medium2

Low0

Versions scanned

Showing 1 of 6 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0 Code review	5

Extension Version	Code Review Findings
1.0.0	5

Files with findings

4 distinct paths — top paths by unique finding count:

manifest.json2
background.bundle.js1
contentScript.bundle.js1
newtab.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Privilege Escalation	high	manifest.json (line 12)	The manifest hijacks the browser's new tab page and simultaneously requests `<all_urls>` / `https:///` host permissions plus `topSites` access, which would let the extension read every page and the user's most-visit…	1.0.0
2	Remote Code Loading	high	manifest.json (line 1)	newtab.html references `/newtab.bundle.js` via a `<script defer>` tag, but that file is not present in the shipped extension package. This is the only script that runs on the hijacked new-tab page, so the malicious / …	1.0.0
3	Tracking	high	newtab.html (line 1)	The new tab override page is pre-wired for Alibaba's aplus.js telemetry/tracking SDK with `log.mmstat.com` and `gm.mmstat.com` as the reporting endpoints and `jstracker` as the WPK beacon id. Every time a user opens a…	1.0.0
4	Other	medium	contentScript.bundle.js (line 1)	The shipped content script is a placeholder from the chrome-extension-boilerplate-react template that does nothing functional, yet the manifest still requests `<all_urls>` host permissions. The mismatch between declar…	1.0.0
5	Tracking	medium	background.bundle.js (line 1)	On every toolbar-icon click the service worker opens a Taobao landing URL with an Alibaba `spm` (Super Position Model) tracking token (`a21bo.29368746.extension.entry`) that uniquely identifies traffic as coming from …	1.0.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
www.w3.org	/TR/2001/REC-SVG-20010904/DTD/svg10.dtd	http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd
github.com	/facebook/regenerator/blob/main/LICENSE	https://github.com/facebook/regenerator/blob/main/LICENSE
huodong.taobao.com	/wow/z/tbhome/default/extension-download-guide	https://huodong.taobao.com/wow/z/tbhome/default/extension-download-guide?spm=a21bo.29368746.extension.entry
reactjs.org	/docs/error-decoder.html	https://reactjs.org/docs/error-decoder.html?invariant=
www.w3.org	/XML/1998/namespace	http://www.w3.org/XML/1998/namespace
www.w3.org	/1998/Math/MathML	http://www.w3.org/1998/Math/MathML
www.w3.org	/1999/xhtml	http://www.w3.org/1999/xhtml
https:	-	https://test-qtracking-xxx.com:port,

Showing 1 to 10 of 50 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


0.0.0.0	IPv4	-
1.2.3.4	IPv4	-
1:2:3:4:5:6:7:8	IPv6	-

1.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

如果是辅助淘宝页面浏览��请把改主页去掉。这点真的很不友好！

白

白白的老白·29 Sept 2024

如果是辅助淘宝页面浏览，请把改主页去掉。这点真的很不友好！

白

白白的老白·29 Sept 2024

我真是f淘宝全家了，都什么年代了一个购物插件改用户主页，阿里还是世纪初的互联网强盗思维，产品经理怎么不去ciciciciicic

art wing·27 Sept 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

淘宝浏览器助手

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 6 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating