Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Ysf Dev Tools

CRITICAL RISKRemoved from Chrome Web Store

Ysf Dev Tools

ID: gpcjfpnlleiknkpnighjkednfiefddlk

Could be malicious

Supported Languages

🇨🇳Chinese (Simplified)

Extension Info & Metadata

Status

Removed

Version

1.11.0

Size

1.44 MB

Rating

5.0/5

Reviews

Users

Type

Extension

Updated

Jul 3, 2026

Publisher Contextual Analysis

Author: ysf2eView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

网易云商研发工具集

网易云商研发工具集 1、优秀文章分享分类工具，随时分享好文给团队成员； 2、支持开发测试环境 cookie 自动同步到本地 localhost，支持一键切换域名（当测试本地切换调试时，不用手动修改域名，地址栏的path和参数也不变），还支持一键切换测试环境账号，不用手动输入账号； 3、前端常用优秀网址聚合。 4、开发代理环境切换。 5、overmind功能增强

User Growth

Showing data from Dec 31, 2022 to Dec 30, 2023

Versions

-12.87%(-13 users)

Compared to 3 months ago

11 versions released in this period

Rating Count

Total: 0 ratings

Average Rating

Current: 0.00 / 5.0

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High0

Medium3

Low3

Versions scanned

Showing 1 of 31 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.10.5 Code review	6

Extension Version	Code Review Findings
1.10.5	6

Files with findings

4 distinct paths — top paths by unique finding count:

background.js3
account_switch.js1
pageWindow_content.js1
ppeffect_content.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Other	medium	background.js (line 6553)	The background service worker hourly proxies a fetch of the extension's Chrome Web Store listing through an unaffiliated public CORS proxy (thingproxy.freeboard.io), then scrapes a version string from the returned HTM…	1.10.5
2	Privilege Escalation	medium	background.js (line 76)	The background exposes a generic __bgFetchData (and fetchData) message handler that takes a caller-supplied URL, method, headers and body and performs the request with credentials:"include" and referrerPolicy:"no-refe…	1.10.5
3	Unauthorized Data Collection	medium	background.js (line 46)	On every cookie change for configured target domains (defaults: ys-test.netease.com, urchin.netease.com; overridable via chrome.storage.sync.targetSites), the extension enumerates ALL cookies for that domain via chrom…	1.10.5
4	Credential Theft	low	account_switch.js (line 18)	On https://ys-test.netease.com/business/login* the script pulls a stored phone number from extension storage and programmatically fills the mobile/verification-code fields (code hardcoded to "9527") and clicks submit,…	1.10.5
5	Tracking	low	ppeffect_content.js (line 5)	The manifest matches ppeffect_content.js and pageWindow_content.js against <all_urls>, and ppeffect_content.js injects pageWindow_content.js into every page's DOM as a <script>. The page-world script then reads window…	1.10.5
6	Unauthorized Data Collection	low	pageWindow_content.js (line 5)	On every http(s) page the extension reads a page-world global (window.PPEffectDiffInfo) and installs a document-wide click listener that walks up from each click target and postMessages element metadata. Any site that…	1.10.5

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

461

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	-	http://127.0.0.1
localhost	-	http://localhost
ys-test.netease.com	/api/console/account/personal/chooseTenant	https://ys-test.netease.com/api/console/account/personal/chooseTenant
ys-test.netease.com	-	https://ys-test.netease.com
urchin.netease.com	-	https://urchin.netease.com
qytest.netease.com	-	https://qytest.netease.com
we-qa.qytest.netease.com	/gateway/exact/openapi/web/codeRelation/uploadRouteParams	http://we-qa.qytest.netease.com/gateway/exact/openapi/web/codeRelation/uploadRouteParams
we-qa.qytest.netease.com	/gateway/exact/openapi/web/codeRelation/setIsCovered	http://we-qa.qytest.netease.com/gateway/exact/openapi/web/codeRelation/setIsCovered
thingproxy.freeboard.io	/fetch	https://thingproxy.freeboard.io/fetch
chromewebstore.google.com	/detail/ysf-dev-tools/gpcjfpnlleiknkpnighjkednfiefddlk	https://chromewebstore.google.com/detail/ysf-dev-tools/gpcjfpnlleiknkpnighjkednfiefddlk

Showing 1 to 10 of 470 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


127.0.0.1	IPv4	-

5.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

very nice

dong wang·25 Nov 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Ysf Dev Tools

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 31 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating