Is Auto Twitch Drops safe?
Auto Twitch Drops is medium risk. Two seconds after launch, and hourly after, the extension asks automaticdrops.com for a config file with a live disabled flag. Flipping that flag switches every install to a disabled screen, no store update needed.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Auto Twitch Drops pulls a remote kill switch from automaticdrops.com every hour
Two seconds after launch, and hourly after, the extension asks automaticdrops.com for a config file with a live disabled flag.
Flipping that flag switches every install to a disabled screen, no store update needed.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You install Auto Twitch Drops, or your browser restarts with it already installed.
The extension immediately requests a config file from automaticdrops.com that can disable it for every user, everywhere.
The same request repeats every 60 minutes for as long as the extension stays installed.
Observed during dynamic analysis: a JSON object with the fields announcement (empty string), disabled (false), claimPoints (true), plus priorityStreams and badgesGameNames arrays. No account-identifying header (td-uuid) was sent with this request.
- td-type
- config
- Content-Type
- text/plain;charset=UTF-8
- Kill switchdisabled: false
Read by every install on every check-in; when true, the popup switches to a disabled screen and normal use stops.
- Channel-point auto-claimclaimPoints: true
Read alongside your premium status to decide whether channel-point auto-claiming is allowed this session.
- Priority streamerspriorityStreams: ["asmongold", "shroud"] (illustrative)
A list of streamer names the extension should prioritize when picking which drop to watch.
- Announcement textannouncement: ""
Free text shown in the popup UI under an Announcement heading.
- Badged gamesbadgesGameNames: ["Path of Exile 2"] (illustrative)
Game names used to decide which drop campaigns show a badge in the popup.
- automaticdrops.com
Vendor-operated config and telemetry API for Auto Twitch Drops; also issues UUIDs and receives per-account claim events (td-uuid header) on other request types.