Who makes AudioTTS - Simple Text to Speech Downloader?

AudioTTS - Simple Text to Speech Downloader is published by baabullah. The same operator publishes 3 other store listings, none of which carry a security finding.

Is AudioTTS - Simple Text to Speech Downloader safe?

High risk

AudioTTS - Simple Text to Speech Downloader is high risk. On supported AI or text-to-speech pages, AudioTTS inserts page scripts that call license.baabullah.my.id for telemetry. The call uses JSONP, so the response loads as JavaScript inside the same page as the extension's code.

baabullahv2.3.0Chrome Web Store

72Risk

Who publishes it

baabullah - 3 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

baabullah

Same store account

3 other listings published from this account, 305 users between them, none of them carrying a finding.

SpeakGPT285Medium BardReadAloud18Medium Reddit Ad Blocker Pro2Medium

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

JSONP telemetry runs server-supplied JavaScript

HighunwantedCWE-829Dynamic sandbox

On supported AI or text-to-speech pages, AudioTTS inserts page scripts that call license.baabullah.my.id for telemetry.

What actually happens

You did this

You use AudioTTS on a supported text-to-speech page.

The shipped call sites are in the Google and Azure text-to-speech flows.

The extension did this

The extension asks license.baabullah.my.id for telemetry using JSONP.

A JSONP response is loaded as a script, so server-supplied JavaScript can run in the page where the extension inserted its helper code.

Fields placed in the /stat query string

Selected speech service
Google
Shows which supported text-to-speech service you were using when the telemetry call was made.
Text length marker
len_1024
Shows the size of the text submitted to the text-to-speech workflow, without including the text itself in this code path.

Captured request

GEThttps://license.baabullah.my.id/stat?engine=Google&message=len_1024

Verification evidence records the JSONP request shape. This GET path has no request body.

The code that does this

The page-script injection and JSONP telemetry path

Readable version

Show shipped source

Readable effect of loadScript

contentscript.js

function loadExtensionScriptIntoPage(file, callback) {  const script = document.createElement('script');  script.src = chrome.runtime.getURL(file);  script.onload = function () {    this.remove();    if (callback != null) {      callback();    }  };  (document.head || document.documentElement).appendChild(script);}

Readable effect of logStatistic

library.js

const telemetryBaseUrl = 'https://license.baabullah.my.id';function callbackStat(data) {}function sendJsonpTelemetry(engine, message) {  if (logstat) {    $.ajax({      url: telemetryBaseUrl + '/stat?' +        'engine=' + encodeURIComponent(engine) +        '&message=' + encodeURIComponent(message),      jsonp: 'callbackStat',      dataType: 'jsonp'    });  }}

Readable effect of callbackConfig

library.js

function applyRemoteConfiguration(data) {  const valid = validateMembership();  const clientid = getUniqueID();  const token = getToken();  GLOBAL_CONFIG = data.CONFIG;  logstat = GLOBAL_CONFIG.LOGSTAT;  timeout1 = GLOBAL_CONFIG.TIMEOUT1;  timeout2 = GLOBAL_CONFIG.TIMEOUT2;  timeout3 = GLOBAL_CONFIG.TIMEOUT3;  GLOBAL_MESSAGE = data.MESSAGES;  EXCEED_MESSAGE = data.MESSAGES.EXCEED_MESSAGE.replaceAll('%CLIENTID%', clientid);  if (valid) {    jQuery('#banner_google_' + valid).html(data.MESSAGES.MEMBER_GOOGLE_BANNER.replaceAll('%CLIENTID%', clientid).replaceAll('%TOKEN%', token));    jQuery('#banner_azure_' + valid).html(data.MESSAGES.MEMBER_AZURE_BANNER.replaceAll('%CLIENTID%', clientid).replaceAll('%TOKEN%', token));  } else {    jQuery('#banner_google_' + valid).html(data.MESSAGES.NONMEMBER_GOOGLE_BANNER.replaceAll('%CLIENTID%', clientid).replaceAll('%TOKEN%', token));    jQuery('#banner_azure_' + valid).html(data.MESSAGES.NONMEMBER_AZURE_BANNER.replaceAll('%CLIENTID%', clientid).replaceAll('%TOKEN%', token));  }}

Readable Google telemetry call

web-gstatic.js

if (this.i === 0) {  try {    sendJsonpTelemetry('Google', 'len_' + text.length);  } catch (error) {    console.log(error);  }}

Readable Azure telemetry call

web-azure.js

if (i === 0) {  try {    sendJsonpTelemetry('Azure', 'len_' + this.completeSsml.length);  } catch (error) {    console.log(error);  }}

External host reached by the JSONP telemetry path

- license.baabullah.my.id
Receives the /stat JSONP request and supplies the JavaScript response for callbackStat.