Is Better Lyrics Shaders safe?

Medium risk

Better Lyrics Shaders sends YouTube Music track metadata to artwork.boidu.dev for animated art.

When animated art is enabled, Better Lyrics Shaders reads the current YouTube Music track title, artist, duration, and album. It sends those values to artwork.boidu.dev to look up an animated-art video URL, and animated art is enabled by default.

Boidushyav1.2.2Chrome Web Store
45Risk
Who publishes it

Boidushya - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Boidushya

Same store account

1 other listing published from this account, 100k+ users between them, none of them carrying a finding.

Better Lyrics (Lyrics for YouTube Music)100k+Clean

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

artwork.boidu.dev
Also called by 1 other listing: ChatGPT File Uploader & Conversation Saver
betterlyrics.org
Also called by 2 other listings, including Better Lyrics (Lyrics for Youtube Music)
boidu.dev
Also called by 2 other listings, including Better Lyrics (Lyrics for Youtube Music)

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Better Lyrics Shaders sends the song you're playing to artwork.boidu.dev

Every time you play or switch tracks on YouTube Music, the extension sends the song title, artist, duration, and album to artwork.boidu.dev to fetch an animated background.

This runs automatically because the feature is on by default.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You play or switch to a new track on music.youtube.com.

The default settings have the animated-art feature turned on.

The extension did this

The extension sends the track's song title, artist, duration, and album to artwork.boidu.dev to look up an animated background.

No consent prompt is shown before the request is sent.

Fields sent in the artwork.boidu.dev request
  • Song title
    What You Need

    The exact title of the track you are currently playing.

  • Artist name
    COLORS & Tems

    The performing artist of the track.

  • Track duration
    239

    The length of the track in seconds, rounded to the nearest second.

  • Album name
    COLORS

    The album the track belongs to, read from the YouTube Music page.

Captured request
GEThttps://artwork.boidu.dev/?s=What+You+Need&a=COLORS+%26+Tems&d=239&al=COLORS

200 OK, JSON body containing a videoUrl for the matching animated background

The code that does this

The animated-art fetch function

Readable version
    async function x(e, t, r, a, i) {      let n = `bls_${t}|${a}`;      try {        let e = await g.get(n);        if (void 0 !== e) {          if ("string" == typeof e) return (0, l.logger).log(`Animated art: cache hit for "${t} - ${a}"`, {            cacheKey: n          }), e;          if ("object" == typeof e && "notFoundAt" in e) {            let r = Date.now() - e.notFoundAt >= 6048e5;            if (!r) return (0, l.logger).log(`Animated art: cache hit (not found) for "${t} - ${a}"`, {              cacheKey: n            }), null;            (0, l.logger).log(`Animated art: not-found cache expired for "${t} - ${a}"`, {              cacheKey: n            })          }        }      } catch (e) {        (0, l.logger).log("Animated art: cache read error", e)      }(0, l.logger).log(`Animated art: fetching for "${t} - ${a}"`, {        cacheKey: n      });      let s = new URLSearchParams({          s: e,          a: t,          d: Math.round(r).toString(),          al: a        }),        o = `https://artwork.boidu.dev?${s.toString()}`;      try {        let e = await fetch(o, {          signal: i        });        if (!e.ok) return (0, l.logger).log("Animated art: API error", e.status), null;        let r = await e.json();        return r.videoUrl ? (await g.set(n, r.videoUrl), (0, l.logger).log(`Animated art: cached "${t} - ${a}"`, {          cacheKey: n        })) : (await g.set(n, {          notFoundAt: Date.now()        }), (0, l.logger).log(`Animated art: cached not-found for "${t} - ${a}"`, {          cacheKey: n        })), r.videoUrl      } catch (e) {        return (0, l.logger).log("Animated art: fetch error", e), null      }    }
Third-party destinations
    • artwork.boidu.dev

    Receives the playing track's song, artist, duration, and album; returns a matching animated background video. Subdomain of boidu.dev, the developer's own domain.

Where it sends data

Destinations our analysis observed Better Lyrics Shaders contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • artwork.boidu.dev

    Better Lyrics Shaders sends data to artwork.boidu.dev. One other extension we have analysed sends data here.

Updated 30 September 2026mffpncjphfmkppebdoaehdlnagnlpfai