Chrome Web Store

KOLTOOL:查找 YouTube、TikTok 和 Instagram 上的相似博主

77f1b495-a0ed-5b2e-bbb4-8bb9b82a945d | v1.0.0
87/ 100
CRITICAL risk
Risk verdict
Do not install

Score-based assessment (critical risk, 87/100). No analyst review available.

Analysis record

Analysed
Yesterday
Version
v1.0.0
Artifact
SHA256 0ED…E8A
Source
Findings (non-IoC)

Evidence ledger

Ranked by severity · findings with a source location link to the code viewer

53 detail rows

YARA Rule Matches

15 rules
SeverityRuleHitsFilesMetadata
HIGHsupply chain sourcemap appended iife 1
js/chunk-vendors.js
-
LOWLocalStorageShouldNotBeUsed 4
js/chunk-vendors.jsjs/browser.jsassets/user.js +1 more
-
LOWcredential env files 2
js/chunk-vendors.jsjs/content.js
-
LOWpostinstall persistence mechanism 2
js/chunk-vendors.jsjs/content.js
-
LOWNoUseEval 1
js/content.js
-
LOWcredential generic tokens 1
js/content.js
-
LOWpostinstall file download 5
js/content.jsjs/fetch.jsjs/background.js +2 more
-
LOWNoUseWeakRandom 3
js/content.jsjs/background.jsjs/chunk-vendors.js
-
LOWpostinstall crypto operations 3
_metadata/verified_contents.jsonjs/chunk-vendors.jsjs/content.js
-
LOWOriginsNotVerified 1
js/chunk-vendors.js
-
LOWpostinstall file manipulation 5
js/action.jsjs/background.jsjs/content.js +2 more
-
LOWpostinstall system command 7
js/background.jscss/content.cssjs/action.js +4 more
-
LOWpostinstall obfuscation 3
css/content.cssjs/content.jsjs/chunk-vendors.js
-
LOWpostinstall network communication 8
css/content.cssjs/background.jsjs/sxhr.js +5 more
-
LOWpostinstall registry modification 1
js/chunk-vendors.js
-

Publisher Evidence

Limited evidence

[email protected]

Publisher identity, store signals, distribution reach, and warning signals used for context. Treat this as supporting evidence, not a clean bill of health.

Chrome does not expose the same publisher verification data as IDE stores, so this score is deliberately conservative.

25
Noisy-finding weight
x1.00
Publisher domain
No domain
Missing
Store verification signal
Limited signal
Limited
Extension portfolio
3
Portfolio

12 evidence rows available.

Finding Categories

1
Malware Signatures
3
Obfuscation
2
Network
771
IoC Indicators

YARA Rules Matched

15 rules(47 hits)
supply chain sourcemap appended iife LocalStorageShouldNotBeUsed credential env files postinstall persistence mechanism NoUseEval credential generic tokens postinstall file download NoUseWeakRandom postinstall crypto operations OriginsNotVerified postinstall file manipulation postinstall system command postinstall obfuscation postinstall network communication postinstall registry modification

Requested Permissions

49 permissions
tabs
Medium
declarativeNetRequest
Low
storage
Low
alarms
Low
scripting
Low
https://buyin.jinritemai.com/*
Low
https://affiliate.tiktokglobalshop.com/*
Low
https://affiliate.tiktokshopglobalselling.com/*
Low
https://affiliate-id.tokopedia.com/*
Low
https://www.wuyoukuajing.com/*
Low
https://eos.douyin.com/*
Low
*://*.tiktokshop.com/*
Low
*://*.tiktok.com/*
Low
*://*.tikclubs.com/*
Low
*://*.tiktokcdn.com/*
Low
*://*.tiktokcdn-eu.com/*
Low
*://*.tiktokcdn-us.com/*
Low
https://*.douyin.com/*
Low
*://*.jinritemai.com/*
Low
https://d.zcxq.com/*
Low
https://wd.zcxq.com/*
Low
https://zs.kwaixiaodian.com/*
Low
https://channels.weixin.qq.com/*
Low
https://*.weixin.qq.com/*
Low
https://liveplatform.taobao.com/*
Low
https://www.xiaohongshu.com/*
Low
*://*.xiaohongshu.com/*
Low
https://*.kwaixiaodian.com/*
Low
https://housengine.com/*
Low
https://www.amazon.com/*
Low
https://www.amazon.co.jp/*
Low
https://www.amazon.co.uk/*
Low
https://www.amazon.de/*
Low
https://www.amazon.fr/*
Low
https://www.amazon.es/*
Low
https://www.amazon.it/*
Low
https://www.amazon.ca/*
Low
https://www.amazon.in/*
Low
https://www.amazon.com.mx/*
Low
https://www.amazon.com.au/*
Low
https://www.amazon.ae/*
Low
https://www.amazon.nl/*
Low
https://www.amazon.pl/*
Low
https://www.amazon.se/*
Low
https://www.amazon.sa/*
Low
https://www.amazon.sg/*
Low
https://www.amazon.com.br/*
Low
https://www.amazon.com.tr/*
Low
https://sellercentral.amazon.com/*
Low

Security Analysis Summary

Security Analysis Overview

KOLTOOL:查找 YouTube、TikTok 和 Instagram 上的相似博主 is a Chrome Web Store extension published by [email protected]. Version 1.0.0 has been analyzed by the Risky Plugins security platform, receiving a risk score of 86.54/100 (CRITICAL risk) based on 824 security findings.

Risk Assessment

This extension presents critical security risk. Severe issues were detected, potentially including malware indicators, exposed secrets, or dangerous behaviors. Installation is strongly discouraged until these issues are addressed.

Findings Breakdown

  • Critical: 1 finding(s)
  • High: 1 finding(s)
  • Medium: 776 finding(s)
  • Low: 46 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

  • Malware Detection: YARA rule matching against 2,400+ malware signatures
  • Secret Detection: Scanning for exposed API keys, tokens, and credentials
  • Static Analysis: Code-level security analysis for common vulnerability patterns
  • Network Analysis: Detection of suspicious network communications and endpoints
  • Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

KOLTOOL:查找 YouTube、TikTok 和 Instagram 上的相似博主 is published by [email protected] on the Chrome Web Store marketplace.

Recommendation

This extension is not recommended for installation without thorough manual review. Consider alternatives with lower risk scores, or contact the developer to address the identified security concerns.

About This Extension

To deliver its core features, this extension performs significant modifications to the Document Object Model (DOM) of YouTube, Instagram, and TikTok pages. This includes actively blocking and hiding certain page elements (like sidebars, recommendation feeds, and comment sections) to provide a clean and accurate environment for data analysis. This "DOM blocking" is a fundamental and necessary function for our tools to work correctly. It is not a simple overlay. By installing this extension, you acknowledge and consent to this behavior. Please read the "Core Features" section below for a detailed breakdown. This is not a passive tool. It is an in-page application that enhances your browsing experience on these specific social media platforms. Core Features (What This Extension Does on the Page): Injects Custom UI & Enhanced Analytics: We inject custom UI components, such as advanced data panels and charts, directly into the social media interface. This allows you to see our enhanced KOL analysis without leaving the page. Replaces Original Statistics: To provide deeper insights, we replace the standard, basic statistics (like follower counts) with more detailed and actionable marketing metrics (e.g., engagement rate, growth trends). DOM Blocking & Modification for a Clean Analysis View: To ensure data accuracy and provide an uncluttered interface for our analytics, the extension actively blocks and hides non-essential page elements. This includes, but is not limited to, sidebars, recommendation carousels, and comment sections. This "DOM blocking" is a fundamental part of our data processing, allowing our custom UI to be displayed correctly. How It Works: By default, after installation, the extension will automatically activate when you visit Instagram, TikTok, or YouTube. User Control & How to Disable: You are in full control. If you wish to view the original, unmodified page, you can easily disable the extension's functionality at any time by: Clicking the extension icon in your browser toolbar. Using the main toggle switch to turn the extension OFF for the current site. Our Commitment to Transparency: We believe in full transparency. This extension's purpose is to fundamentally enhance the way you analyze social media pages by modifying them. We do not collect any of your personal data. Please review our privacy policy for more details. Influencer marketing is booming—but let's be honest, finding the right content creators, tracking their performance, and handling outreach can be a huge time suck. Enter KOLTOOL—your all-in-one toolkit designed specifically for collaborating with influencers on YouTube, TikTok, and Instagram. Whether you're a startup looking to make a splash or a seasoned media buyer handling dozens of campaigns, KOLTOOL makes it faster, smarter, and way more efficient to connect with creators who actually drive results.

Frequently Asked Questions