花瓣采集插件
The AI review rates the findings as likely false positive, but the risk score (85/100) still counts them.
Analysis record
- Analysed
- 2 days ago
- Version
- v2.3.4
- Artifact
- SHA256 23F…DC6
- Source
- Findings (non-IoC)
Is 花瓣采集插件 safe?
花瓣采集插件 clips images, videos and page screenshots from other sites into a Huaban board, and it is published by 稿定（厦门）信息服务有限公司, the company behind huaban.com. The manifest as scanned lists no permission strings and no host permissions, which is odd for a tool that has to read the pages you are visiting and probably means the scan could not read them. The hosts it talks to are the places you would be collecting from: 500px.com, artstation.com, app.pixverse.ai, artboard.studio, b23.tv, and an image CDN at 360buyimg.com.
Two files drew obfuscation labels. background.806a2724.js is named after a content hash and packs onto a single line, which is what happens when a developer ships webpack output. The label OBfuscation-UNICODE_HEAVY fires on a high proportion of non-Latin characters, and this extension's buttons and menus are in Chinese, so its strings are full of them. mediaFrameAgent.e327b2d3.js triggers FROMCHARCODE_BULK, a pattern that turns up whenever minified code builds image data or base64 strings.
The indicator list is where the sheer volume comes from, and much of it is not hostnames at all. ant-pagination-rtl.ant-pagination.mini and batch-pin-modal-wrapper.mini are CSS class names from an Ant Design component library that got read as domains. The scanner tripped on how the code is packaged and how Chinese text encodes, not on anything the extension did with your data.
Evidence ledger
Ranked by severity · findings with a source location link to the code viewer
YARA Rule Matches
12 rules| Severity | Rule | Hits | Files | Metadata |
|---|---|---|---|---|
| LOW | credential env files | 6 | contents.04d427ca.jsbackground.806a2724.jstabs/batchUpload.34596e07.js +3 more | - |
| LOW | postinstall persistence mechanism | 5 | contents.04d427ca.jsbackground.806a2724.jstabs/batchUpload.34596e07.js +2 more | - |
| LOW | postinstall crypto operations | 8 | contents.04d427ca.jstabs/pin.2fb17a23.jsmediaFrameAgent.e327b2d3.js +5 more | - |
| LOW | OriginsNotVerified | 1 | tabs/pin.2fb17a23.js | - |
| LOW | postinstall file manipulation | 10 | contents.04d427ca.jspinitBridge.6908f1aa.jsfeedReadCursor.faba532e.js +7 more | - |
| LOW | postinstall network communication | 13 | tabs/pin.4edbcadb.cssMETA-INF/manifest.mfpopup.0f820471.js +10 more | - |
| LOW | postinstall environment access | 3 | tabs/pin.2fb17a23.jspopup.0f820471.jstabs/batchUpload.34596e07.js | - |
| LOW | postinstall obfuscation | 7 | contents.04d427ca.jsbackground.806a2724.jstabs/pin.2fb17a23.js +4 more | - |
| LOW | postinstall system command | 9 | contents.04d427ca.jstabs/batchUpload.34596e07.jsbackground.806a2724.js +6 more | - |
| LOW | postinstall file download | 9 | klingMainWorldBridge.25ab7f1d.jsweiboMainWorldBridge.ca28ef57.jscontents.04d427ca.js +6 more | - |
| LOW | NoUseWeakRandom | 8 | contents.04d427ca.jsbackground.806a2724.jstabs/pin.2fb17a23.js +5 more | - |
| LOW | LocalStorageShouldNotBeUsed | 5 | tabs/batchUpload.34596e07.jscontents.04d427ca.jsbackground.806a2724.js +2 more | - |
Network Indicators
Concrete URLs, domains, IPs, emails, and hashes extracted from the analyzed artifact.
Loading network indicators
IoC detail rows are loaded outside the initial page render.
Publisher Evidence
Limited evidence稿定（厦门）信息服务有限公司
Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.
Firefox does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.
13 evidence rows available.
Finding Categories
YARA Rules Matched
12 rules(84 hits)Requested Permissions
27 permissionsManage other installed extensions
Access and modify data on every website you visit
AI Security Report
AI Security Review
Evidence context: threat category none; evidence quality moderate.
花瓣采集插件 is Huaban's official clipping tool. The description names huaban.com and the publisher is 稿定（厦门）信息服务有限公司, the Xiamen company behind the site. Against that context the 535 recorded results say less than the count implies: zero malware signatures, zero malware, zero secrets, zero dependency findings, zero tool poisoning, zero network findings. The volume comes from 446 indicator matches and 84 low-severity code-quality results, with three obfuscation labels on top. None of the code-smell results carries a malware family name.
The obfuscation labels sit on two files. background.806a2724.js:41 carries OBfuscation-UNICODE_HEAVY-background.806a2724.js-41 at high severity and OBfuscation-FUNCTION_INDIRECT-background.806a2724.js-41 at medium, both on line 41 of a file named with a content hash. A hashed filename plus one dense line is bundler output, and this extension's interface is Chinese, so a high ratio of non-Latin characters in its string table is ordinary. mediaFrameAgent.e327b2d3.js:11 holds OBfuscation-FROMCHARCODE_BULK-mediaFrameAgent.e327b2d3.js-11. String.fromCharCode at scale shows up in minified code that assembles image or base64 data, which is the job of a media frame agent in a clipping tool.
The 446 indicator matches resolve to image and art platforms the tool reads while collecting: 500px.com, 500pxcdn.com, artstation.com, artboard.studio, app.pixverse.ai, app.leonardo.ai, b23.tv, and the JD.com image CDN at 360buyimg.com. Several entries in the same list are not hosts at all. ant-pagination-rtl.ant-pagination.mini and batch-pin-modal-wrapper.mini are Ant Design CSS class names, and entries such as ao.gold and ae.pin match short property chains. Nothing listed resolves to a search-hijack host, a login page, or a token endpoint.
The counterargument worth taking seriously is that both the permissions and host_permissions arrays came back empty, which is hard to square with a tool that reads whichever page you are on, and an obfuscated background script is exactly where an upload path would hide. The endpoint list answers it: every real host in it is a public image or art platform plus one retailer's CDN. A collector running a covert upload channel needs a domain that belongs to nobody else, and none is present. The two manifest-analysis results are also unaccounted for, so the permission picture is incomplete rather than clean. That gap is why this lands as a false positive call with room to spare rather than a clean bill.
Key Reasons
- Publisher is 稿定（厦门）信息服务有限公司 with a description naming huaban.com as the official source
- Zero malware signatures, zero secrets, zero tool-poisoning and zero network findings across 535 results
- 446 indicator matches are image and art platforms (500px.com, artstation.com, 360buyimg.com) plus CSS class names like batch-pin-modal-wrapper.mini misread as domains
- Obfuscation labels sit on hash-named bundles: background.806a2724.js:41 (UNICODE_HEAVY, FUNCTION_INDIRECT) and mediaFrameAgent.e327b2d3.js:11 (FROMCHARCODE_BULK)
- No search-hijack, login, or token endpoint appears anywhere in the network endpoint list
False Positive Considerations
- IoC extractor parsing minified property chains and Ant Design CSS class names as hostnames
- Obfuscation rules firing on webpack bundle output and Chinese-language string tables
- Low-severity code-smell rules matching bundled JavaScript
- Manifest permissions and host_permissions parsed as empty, limiting what could be verified
Reviewed 2026-10-17; recommended action: suppress false positive; model confidence 82%.
Firefox version history
Risk trend by version
12 analyzed versions. Each point is the latest successful scan for that version; failed zero-score scans are hidden. Dates are based on first seen by risky plugins.
Pick any point on the chart to explore that version's code below.
Source Code Not Available
Source code is not available for this version of the extension.
Frequently Asked Questions
Similar Extensions
Related extensions from the same publisher or marketplace