Yueshang

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Yueshang is a Firefox add-on published by BriefFeed, version 1.2.11, that reshapes how web.okjike.com looks: typography, repost previews, profile cards and image zooming. The manifest data lists no permissions and no host permissions, and the endpoints the code reaches are web.okjike.com, api.ruguoapp.com, jikepolish.com and bowugit.github.io.

Five network findings cover the fetching: NET-FETCH-content.js-829, NET-FETCH-content.js-857 and NET-FETCH-content.js-1295 in content.js, plus NET-FETCH-jike-polish-page-bridge.js-296 and NET-FETCH-jike-polish-page-bridge.js-324. Every one lands in code that has to make requests. A repost preview or a profile card cannot render without pulling post data, and api.ruguoapp.com is Jike's own API host. jikepolish.com carries the extension's own name, and the file it lives in is called jike-polish-page-bridge.js. Nothing points at an unrelated collection server.

Two high-severity obfuscation findings sit at content.js:1101 and jike-polish-page-bridge.js:147, both titled OBFUSCATION-UNICODE_HEAVY. That check measures how much of a file is non-ASCII. This extension is written to handle Chinese-language content on a Chinese social network, so its strings, its regexes and its emoji run through a large part of the source. No packed payload, no eval chain and no malware signature was reported. Across the whole scan, malware-signature and malware both come back at zero, as do secret and dependency findings.

The 25 indicators of compromise are the weakest part of the evidence. They include button.is, lightbox-viewport.is, window.show, html.jp, image.jp, jp-follow.jp, user.bio and globalthis.chrome. Those are fragments of JavaScript property access read as hostnames, because .is, .jp, .bio, .show and .chrome look like top-level domains to a pattern matcher. bowugit.github.io is a GitHub Pages host and mozilla.com belongs to the browser vendor. None of them is a destination for stolen data.

A skeptic could argue the other way. The unicode-heavy rating is marked high, five network calls is a real number of calls, and the source is not in front of us. The strongest counterargument is that we are trusting filenames and endpoint lists rather than reading content.js around lines 829 to 1295. What would settle it is exactly that read: confirm those fetches hit web.okjike.com and api.ruguoapp.com, and confirm the non-ASCII volume is Chinese text and emoji. What we can say now is that an extension with no declared permissions, no malware signature, no credential or cookie access and no endpoint outside the site it modifies has not shown any behavior worth flagging.

Key Reasons

• Zero malware, malware-signature, secret and dependency findings across 49 total; the 17 code-smell hits are the standard noise class.
• All five NET-FETCH findings (content.js:829, content.js:857, content.js:1295, jike-polish-page-bridge.js:296, jike-polish-page-bridge.js:324) sit in the code paths required for the documented repost preview and profile card features.
• Endpoints resolve to web.okjike.com and api.ruguoapp.com (Jike's own API) plus jikepolish.com, which matches the filename jike-polish-page-bridge.js.
• The 25 IoCs are JavaScript property chains (button.is, window.show, html.jp, user.bio, globalthis.chrome) parsed as hostnames.
• OBFUSCATION-UNICODE_HEAVY at content.js:1101 and jike-polish-page-bridge.js:147 reflects Chinese-language and emoji content, not a packed payload.

False Positive Considerations

• IoC extractor reading JavaScript property access chains (.is, .jp, .bio, .show, .chrome) as domains
• Unicode density heuristic firing on CJK text and emoji in a Chinese-language extension
• Code-smell rules firing on ordinary bundled JavaScript
• Network findings generated by any fetch() call, regardless of destination

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 75%.