Ship Xanh copy sản phẩm, nhân bản shop, hiển thị % phí sàn, lượt bán tháng

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The extension listing describes tools for copying products and managing shops across Shopee, TikTok, Lazada, 1688, and Taobao. The code paths tied to the findings are assets/chunk-3cfb730f.js:1:0, assets/chunk-ea756fd5.js:3:0, and assets/chunk-77e9fb52.js:38:0 through :40:0. Their titles identify fetch and Socket.IO activity, which fits a web tool that exchanges product, stock, order, or shop data with a service. The supplied endpoint list is empty, so these findings identify network behavior without naming a destination domain.

The strongest signal in the supplied material is NET-SOCKET_IO-assets/chunk-77e9fb52.js-38 and NET-SOCKET_IO-assets/chunk-77e9fb52.js-40. Socket.IO supports persistent client-server updates, which can fit live inventory or order status features described by the listing. NET-FETCH-assets/chunk-3cfb730f.js-1 and NET-FETCH-assets/chunk-ea756fd5.js-3 identify ordinary request code in bundled JavaScript. These titles do not identify credential collection, cookie access, search replacement, injected advertising, proxy routing, or data sent to a suspicious domain.

The absence of a destination domain limits what can be confirmed about the network calls. Still, the listed paths contain no IoC finding, malware signature, obfuscation finding, secret finding, or tool-poisoning finding. assets/chunk-3cfb730f.js:1:0, assets/chunk-ea756fd5.js:3:0, and assets/chunk-77e9fb52.js:38:0 therefore provide evidence of application communications, rather than evidence of a harmful payload. The empty permissions list also gives the extension no declared special browser permission in the supplied metadata.

A skeptic could argue that Socket.IO activity in assets/chunk-77e9fb52.js:38:0 and :40:0 might support hidden tracking or remote control. That concern cannot be resolved from these titles alone because the endpoint list is empty and the finding descriptions contain no destination or payload detail. It also lacks support from the other recorded indicators: NET-FETCH-assets/chunk-3cfb730f.js-1 and NET-FETCH-assets/chunk-ea756fd5.js-3 are generic fetch detections, while no IoC, malware, obfuscation, or secret finding is recorded. Runtime URL inspection would be needed to establish a harmful destination.

The available evidence therefore supports treating these findings as bundled application network behavior. The remaining uncertainty comes from the missing endpoint details, rather than from a concrete malicious indicator in the cited files.

Key Reasons

• NET-FETCH-assets/chunk-3cfb730f.js-1 and NET-FETCH-assets/chunk-ea756fd5.js-3 identify generic fetch code in bundled application files.
• NET-SOCKET_IO-assets/chunk-77e9fb52.js-38 and NET-SOCKET_IO-assets/chunk-77e9fb52.js-40 fit live shop or inventory communication.
• The supplied endpoint list and permissions list are empty.
• No malware, obfuscation, IoC, secret, or tool-poisoning finding is tied to the cited paths.

False Positive Considerations

• Generic fetch detections in assets/chunk-3cfb730f.js:1:0 and assets/chunk-ea756fd5.js:3:0.
• Socket.IO detections in bundled code at assets/chunk-77e9fb52.js:38:0 and :40:0.
• The network endpoint list is empty, so the scanner supplies no suspicious destination domain.
• No malware or obfuscation finding is associated with the cited JavaScript paths.

Reviewed 2026-09-30; recommended action: suppress false positive; model confidence 88%.