Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Taobao Shopping Cart Assistant - One-click Export Product L… is rated caution by Extension Auditor. Our code review reported 2 findings (1 high, 1 medium), led by other. Its permissions mean it can read and change data on all websites and can inject scripts into pages.
Key findings
- High
Other
The bundled manifest grants `<all_urls>` plus the two broad wildcard host_permissions (`[domain withheld], `[domain withheld]), whereas the published CWS manifest restricts host_permissions to twelve named e-commerce domains ([domain withheld], [domain withheld], [domain withheld], [domain withheld], [domain withheld], six Amazon TLDs, [domain withheld]). This means every user who installs the extension receives page-access on all websites, not just the shopping platforms declared publicly. The web_accessible_resources similarly cover all URLs in the bundle versus only the named domains in the listing. A divergence between the uploaded ZIP and the CWS-published manifest is itself a finding.
- Medium
Network Interception
The inject-script defines a `GET_HOST_REQUEST_HEADERS` action that irreversibly patches `XMLHttpRequest.prototype.setRequestHeader` and `XMLHttpRequest.prototype.open` for the lifetime of any page it runs in. Once activated, every XHR call on that page has its request headers (potentially including Authorization, Cookie, X-CSRF-Token, and other auth tokens set by the site's own scripts) captured; those that match any registered URL pattern are exfiltrated via `postMessage`. Because the content_scripts match `[domain withheld] (all URLs, per the bundled manifest), this hook can fire on any website — not just the declared e-commerce platforms — and the content-script (absent from the bundle) controls which URL patterns get registered. The mechanism name `GET_HOST_REQUEST_HEADERS` unambiguously describes capture from the host page's network calls.
Analyst notes
The bundled manifest declares `<all_urls>`, `[domain withheld], and `[domain withheld] as host_permissions while the published CWS manifest lists only twelve specific e-commerce domains — a concrete discrepancy meaning the installed extension has vastly broader page access than what the listing advertises. The also permanently patches `XMLHttpRequest.prototype` globally (action `GET_HOST_REQUEST_HEADERS`) to intercept request headers from any XHR on any page where the content-script triggers it; since content scripts match `[domain withheld], this capability exists on every site. All observed API traffic routes only to [domain withheld] (the publisher's own domains), which corroborates the extension's legitimate shopping-assistant purpose and argues against the ML verdict of medium-risk, but the permission-scope mismatch and prototype-level XHR hook are genuine concerns that prevent a clean clearance, especially given the bundle is incomplete ( and — the service worker and main content script — are absent from the provided files).
Taobao Shopping Cart Assistant - One-click Export Product List Chrome extension security report
ID: fohlpdnckbhaekfdggmojnjljjbhbclb
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- Jim
- Privacy
- Privacy Policy
- Country
- United States
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
- Address
- 1944 Peters Creek Rd NW Roanoke, VA 24017 United States
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
- 1 high
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
一键抓取并导出淘宝购物车商品数据至 Excel/CSV，支持单价、规格及店铺链接。支持中（简体）日韩俄英语（美国）五国语言
Read the publisher’s full description
详细描述： 功能亮点： 一键导出： 支持一键导出淘宝购物车内的商品标题、单价、规格属性及商品链接。 支持以图搜图功能，帮助您在全网寻找同款商品。 五国语言： 完美适配中、英、日、韩、俄五种语言。 提效神器： 告别手动复制，快速生成采购清单。 “本工具不仅支持淘宝，还兼容 1688、Amazon、AliExpress 等多个主流电商平台”
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 high-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from Jim
- 1688图片批量下载1,000 users
- 拼多多图片下载524 users
- TB Image Downloader411 users
- 虾皮价格追踪器405 users
- AliWangWang Translate - Chat Translator for 1688285 users
Popular in Shopping
- PayPal Honey: Automated Coupons & Rewards13,000,000 users
- Avira Safe Shopping7,000,000 users
- 中国工商银行密码扩展5,849,774 users
- Capital One Shopping: Save Now5,422,697 users
- PayPal Honey: Automated Coupons & Rewards4,975,534 users