[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

Shopee Fans - Shopee Seller Assistant

Version 8.7.5 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: shopeefans.com

Rating: 4.6 ★ (122 ratings)

Users: 30,000

Context-Aware Verdict

CRITICAL

Overall Risk

Trust Factors:

The extension has a decent user base of 30,000 users and a good rating of 4.6 stars from 122 reviews, which suggests legitimate functionality. The developer domain shopeefans.com appears to be focused on Shopee seller tools, which aligns with the extension's stated purpose as a seller assistant.

Concerns:

The extension presents significant security risks due to its extremely broad permissions and access scope. The all_urls host permission combined with access to dozens of major e-commerce platforms (Shopee, Amazon, AliExpress, Lazada, TikTok Shop, etc.) creates a massive attack surface. The downloads permission allows file downloads which could be exploited for malware distribution. Cookie access across all these platforms could enable session hijacking or account compromise. The webNavigation permission enables comprehensive browsing tracking across all visited sites. The combination of these permissions with such broad host access creates potential for data theft, financial fraud, or comprehensive user surveillance.

Recommendations:

Given the critical risk level, install this extension only in a completely separate Chrome profile isolated from personal browsing and sensitive accounts. Never use the same profile for banking, personal email, or other sensitive activities. Consider whether the seller assistant functionality truly requires such extensive permissions - many legitimate tools operate with much more limited access. Monitor your accounts closely for any suspicious activity if you choose to use this extension. Consider alternative Shopee seller tools with more restricted permissions.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: downloads

This extension has the downloads permission. Can download files and access download history. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: notifications

This extension has the notifications permission. Can show notifications.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

Security Analysis Details

Required Permissions:

declarativeNetRequest
downloads
notifications
storage
cookies
webNavigation
contextMenus
alarms

Host Permissions:

<all_urls>

Embedded URLs (259 total):

https://xiapi.xiapibuy.com	https://shopee.tw
https://sg.xiapibuy.com	https://shopee.sg
https://my.xiapibuy.com	https://shopee.com.my
https://ph.xiapibuy.com	https://shopee.ph
https://id.xiapibuy.com	https://shopee.co.id
https://th.xiapibuy.com	https://shopee.co.th
https://vn.xiapibuy.com	https://shopee.vn
https://br.xiapibuy.com	https://shopee.com.br
https://mx.xiapibuy.com	https://shopee.com.mx
https://cl.xiapibuy.com	https://shopee.cl
https://co.xiapibuy.com	https://shopee.com.co
https://pl.xiapibuy.com	https://shopee.pl
https://fr.xiapibuy.com	https://shopee.fr
https://es.xiapibuy.com	https://shopee.es
https://dianba6.com	https://open-api.dianba6.com/api/v1/member/info
https://localforage.github.io/localForage	https://mozilla.github.io/localForage/#definedriver
https://dh-cn-zhangjiakou.aliyuncs.com	https://github.com/js-cookie/js-cookie
https://oapi.dingtalk.com/robot/send	https://feross.org/opensource
https://www.amazon.com/shopthelook	https://www.amazon.com
http://openexchangerates.github.io/accounting.js/	https://www.1688.com
https://h5api.m.1688.com/h5/mtop.1688.shop.data.get/1.0/	https://cbu01.alicdn.com/
https://detail.1688.com/offer/	https://store.taobao.com/shop/view_shop.htm?user_number_id=
https://sendike.tmall.com/shop/view_shop.htm?user_number_id=	https://h5api.m.1688.com/h5/mtop.1688.imageservice.putimage/1.0/
https://search.1688.com/service/imageSearchOfferResultViewService	https://overseas.1688.com/api/pdt/oss-token
https://overseas.1688.com/pdtimg	https://cbu-pdtimg-fx.1688.com/
https://overseas.1688.com/api/pdt/search-offers	https://global.1688.com
https://pifa.pinduoduo.com	https://pifa.pinduoduo.com/
https://pifa.pinduoduo.com/mille/slow/upload/uploadSearchImage	https://pifa.pinduoduo.com/pifa/search/searchImageGoods
https://mobile.yangkeduo.com/goods.html?goods_id=	https://pifa.pinduoduo.com/goods/detail?gid=
https://pifa.pinduoduo.com/mall?mid=	https://mobile.yangkeduo.com/
https://api.pinduoduo.com/file/signature?pdduid=	https://file.pinduoduo.com/general_file?sign=
https://api.yangkeduo.com/api/search/img?pdduid=	https://github.com/facebook/regenerator/blob/main/LICENSE
https://fengyuanchen.github.io/compressorjs	https://wapi.shopeefans.com
https://shopeefans.tikotu.com	https://s-cf-tw.shopeesz.com
https://s-cf-id.shopeesz.com	https://s-cf-my.shopeesz.com
https://s-cf-sg.shopeesz.com	https://s-cf-th.shopeesz.com
https://s-cf-vn.shopeesz.com	https://s-cf-ph.shopeesz.com
https://s-cf-mx.shopeesz.com	https://s-cf-cl.shopeesz.com
https://s-cf-br.shopeesz.com	https://s-cf-co.shopeesz.com
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/runtime/onMessage	http://www.w3.org/1999/xlink

Page 1 of 4

Raw Manifest

{
  "name": "__MSG_EXTENSION_NAME__",
  "icons": {
    "16": "icons/logo_16.png",
    "32": "icons/logo_32.png",
    "48": "icons/logo_48.png",
    "128": "icons/logo_128.png"
  },
  "action": {
    "default_icon": {
      "16": "icons/logo_16.png",
      "32": "icons/logo_32.png",
      "48": "icons/logo_48.png",
      "128": "icons/logo_128.png"
    },
    "default_popup": "popup.html",
    "default_title": "Shopee Fans"
  },
  "version": "8.7.5",
  "background": {
    "service_worker": "js/background.js"
  },
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_EXTENSION_DESCRIPTION__",
  "permissions": [
    "declarativeNetRequest",
    "downloads",
    "notifications",
    "storage",
    "cookies",
    "webNavigation",
    "contextMenus",
    "alarms"
  ],
  "homepage_url": "http://www.shopeefans.com/",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "js/content-script.js"
      ],
      "css": [
        "assets/css/content-script.css"
      ],
      "matches": [
        "*://*.shopee.tw/*",
        "*://shopee.tw/*",
        "*://*.shopee.cn/*",
        "*://shopee.cn/*",
        "*://*.shopeesz.com/*",
        "*://*.shopee.co.id/*",
        "*://shopee.co.id/*",
        "*://*.shopee.vn/*",
        "*://shopee.vn/*",
        "*://shopee.co.th/*",
        "*://*.shopee.co.th/*",
        "*://shopee.ph/*",
        "*://*.shopee.ph/*",
        "*://shopee.com.my/*",
        "*://*.shopee.com.my/*",
        "*://shopee.sg/*",
        "*://*.shopee.sg/*",
        "*://shopee.com/*",
        "*://*.shopee.com/*",
        "*://shopee.com.br/*",
        "*://*.shopee.com.br/*",
        "*://shopee.com.mx/*",
        "*://shopee.cl/*",
        "*://*.shopee.cl/*",
        "*://*.shopee.com.co/*",
        "*://*.shopee.pl/*",
        "*://shopee.fr/*",
        "*://*.shopee.fr/*",
        "*://shopee.es/*",
        "*://*.shopee.es/*",
        "*://*.keyouyun.com/*",
        "*://*.1688.com/*",
        "*://*.lazada.com.my/*",
        "*://*.lazada.co.id/*",
        "*://*.lazada.com.ph/*",
        "*://*.lazada.sg/*",
        "*://*.lazada.co.th/*",
        "*://*.lazada.vn/*",
        "*://lazada.cn/*",
        "*://*.aliexpress.com/*",
        "*://aliexpress.ru/*",
        "*://*.aliexpress.ru/*",
        "*://aliexpress.us/*",
        "*://*.aliexpress.us/*",
        "*://*.xiapibuy.com/*",
        "*://*.taobao.com/*",
        "*://*.tmall.com/*",
        "*://*.tmall.hk/*",
        "*://mobile.yangkeduo.com/*",
        "*://app.yangkeduo.com/*",
        "*://yangkeduo.com/*",
        "*://mobile.pinduoduo.com/*",
        "*://pifa.pinduoduo.com/*",
        "*://*.17zwd.com/*",
        "*://www.amazon.co.uk/*",
        "*://www.amazon.de/*",
        "*://www.amazon.fr/*",
        "*://www.amazon.es/*",
        "*://www.amazon.it/*",
        "*://www.amazon.nl/*",
        "*://www.amazon.se/*",
        "*://www.amazon.com/*",
        "*://www.amazon.ca/*",
        "*://www.amazon.com.mx/*",
        "*://www.amazon.com.br/*",
        "*://www.amazon.ae/*",
        "*://www.amazon.sa/*",
        "*://www.amazon.com.tr/*",
        "*://www.amazon.in/*",
        "*://www.amazon.sg/*",
        "*://www.amazon.com.au/*",
        "*://www.amazon.cn/*",
        "*://www.amazon.co.jp/*",
        "*://shopeefans.com/*",
        "*://*.shopeefans.com/*",
        "*://*.vvic.com/*",
        "*://vvic.com/*",
        "*://haohuo.jinritemai.com/*",
        "*://*.tiktok.com/view/product/*",
        "*://shop.tiktokglobalshop.com/*",
        "*://*.tiktokglobalshop.com/*",
        "*://*.temu.com/*"
      ],
      "all_frames": false
    },
    {
      "js": [
        "js/content-pre.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.shopee.tw/*",
        "*://shopee.tw/*",
        "*://*.shopee.cn/*",
        "*://shopee.cn/*",
        "*://*.shopeesz.com/*",
        "*://*.shopee.co.id/*",
        "*://shopee.co.id/*",
        "*://*.shopee.vn/*",
        "*://shopee.vn/*",
        "*://shopee.co.th/*",
        "*://*.shopee.co.th/*",
        "*://shopee.ph/*",
        "*://*.shopee.ph/*",
        "*://shopee.com.my/*",
        "*://*.shopee.com.my/*",
        "*://shopee.sg/*",
        "*://*.shopee.sg/*",
        "*://shopee.com/*",
        "*://*.shopee.com/*",
        "*://shopee.com.br/*",
        "*://*.shopee.com.br/*",
        "*://shopee.com.mx/*",
        "*://shopee.cl/*",
        "*://*.shopee.cl/*",
        "*://*.shopee.com.co/*",
        "*://*.shopee.pl/*",
        "*://shopee.fr/*",
        "*://*.shopee.fr/*",
        "*://shopee.es/*",
        "*://*.shopee.es/*",
        "*://*.keyouyun.com/*",
        "*://*.1688.com/*",
        "*://*.lazada.com.my/*",
        "*://*.lazada.co.id/*",
        "*://*.lazada.com.ph/*",
        "*://*.lazada.sg/*",
        "*://*.lazada.co.th/*",
        "*://*.lazada.vn/*",
        "*://lazada.cn/*",
        "*://*.aliexpress.com/*",
        "*://aliexpress.ru/*",
        "*://*.aliexpress.ru/*",
        "*://aliexpress.us/*",
        "*://*.aliexpress.us/*",
        "*://*.xiapibuy.com/*",
        "*://*.taobao.com/*",
        "*://*.tmall.com/*",
        "*://*.tmall.hk/*",
        "*://mobile.yangkeduo.com/*",
        "*://app.yangkeduo.com/*",
        "*://yangkeduo.com/*",
        "*://mobile.pinduoduo.com/*",
        "*://pifa.pinduoduo.com/*",
        "*://*.17zwd.com/*",
        "*://www.amazon.co.uk/*",
        "*://www.amazon.de/*",
        "*://www.amazon.fr/*",
        "*://www.amazon.es/*",
        "*://www.amazon.it/*",
        "*://www.amazon.nl/*",
        "*://www.amazon.se/*",
        "*://www.amazon.com/*",
        "*://www.amazon.ca/*",
        "*://www.amazon.com.mx/*",
        "*://www.amazon.com.br/*",
        "*://www.amazon.ae/*",
        "*://www.amazon.sa/*",
        "*://www.amazon.com.tr/*",
        "*://www.amazon.in/*",
        "*://www.amazon.sg/*",
        "*://www.amazon.com.au/*",
        "*://www.amazon.cn/*",
        "*://www.amazon.co.jp/*",
        "*://shopeefans.com/*",
        "*://*.shopeefans.com/*",
        "*://*.vvic.com/*",
        "*://vvic.com/*",
        "*://haohuo.jinritemai.com/*",
        "*://*.tiktok.com/view/product/*",
        "*://shop.tiktokglobalshop.com/*",
        "*://*.tiktokglobalshop.com/*",
        "*://*.temu.com/*"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "ruleset_1",
        "path": "rules.json",
        "enabled": true
      }
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "*://*/*"
      ],
      "resources": [
        "assets/*",
        "icons/*",
        "js/*",
        "images/*"
      ]
    }
  ]
}

by ✦ Astarte

Shopee Fans - Shopee Seller Assistant

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Host Permissions:

Embedded URLs (259 total):

Raw Manifest

Detections

Manifest Findings