Is 笔笔·bilibili视频批量下载助手 safe?

Medium risk

The extension sends the host and full URL of every page you visit to huoxiaqu.com.

A content script runs on all websites and reports each page's host and full URL to huoxiaqu.com, along with a persistent user ID and session ID. This is in addition to its stated purpose of batch-downloading bilibili videos.

Do Itv1.0.3Chrome Web Store
49Risk
Who publishes it

Do It - 7 other listings from the same operator, 6 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Do It

Same store account

7 other listings published from this account, 862 users between them. 6 of them carry a finding.

全蛙 · 多电商平台商品图下载助手383Medium阿蛙 · 阿里巴巴1688商品图下载助手189Medium京蛙 · 京东图片下载121Low淘蛙 · 淘宝天猫图片下载113Medium云链 - Tiktok视频下载39MediumTM蛙 · Temu图片下载17Medium1 more listing in the relationship graph, on paid plans →

Shared hosts - 2 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

huoxiaqu.com
Also called by 3 other listings: 希蛙 · 希音图片下载 shein image download, 界图-图片批量下载, 红鸟-X/推特下载助手
123apps.com
Also called by 4 other listings, including Web Apps by 123apps, Web Apps by 123apps

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Bilibili downloader reports every page you visit on any site to huoxiaqu.com

Code analysis shows a content script on all sites sends each page's host and full URL, with a persistent user ID and session ID, to huoxiaqu.com, although the downloader only needs bilibili.com.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You load any web page, on any site.

No bilibili.com page is required.

The extension did this

The extension sends that page's host and full URL to huoxiaqu.com.

The request carries a stored user ID and session ID.

The code that does this

Content script and background handler

Readable version

Content script

js/content.js
chrome.runtime.sendMessage({type:"recordVisitor",fromChannel:"content",host:window.location.host,url:window.location.href});

Background handler

js/background.js
function v(e = "popup", r, o) {  chrome.storage.local.get(["userId", "sessionId", "paidUsers"], function(s) {    s.sessionId || (s.sessionId = Math.random().toString(36).substr(2, 10), chrome.storage.local.set({      sessionId: s.sessionId    })), u.recordVisitor({      userId: s.userId,      fromChannel: e,      sessionId: s.sessionId,      host: r,      url: o,      paidUsers: s.paidUsers    }).catch(a => console.log("Error:", a))  })}

Request wrapper

assets/request-D90E6teb.js
recordVisitor: async r => {  const e = await o("/api/visitor/visitorRecord", {    method: "POST",    body: r  });  return e && typeof e == "object" && "error" in e, e}
Fields in the visitorRecord request body (from code)
  • Page URL
    https://www.example.com/account/orders?id=48213#details

    The full address of the page you are on, including query string and fragment.

  • Host
    www.example.com

    The site you are visiting.

  • User ID
    u_83f2a91c (illustrative)

    A stored identifier that links visits to the same installation.

  • Session ID
    k3j9x0a2bq (illustrative)

    A random 10 character value generated once and reused.

  • Channel and paid flag
    content

    Source label (content) and the stored paid-user status.

Where the data goes
    • huoxiaqu.com

    Receives the POST to /api/visitor/visitorRecord with plugCode and sessionId headers.

Scope mismatch

The downloader's host_permissions are limited to bilibili.com, but this content script is declared for all URLs, so the reporting reaches pages outside that scope.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 1.0.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on bilibili.com

    *://*.bilibili.com/*

  • Store data in your browser

    storage

  • Show a panel beside the page

    sidePanel

  • Act on the current tab, but only after you click the extension

    activeTab

Where it sends data

Destinations our analysis observed 笔笔·bilibili视频批量下载助手 contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • huoxiaqu.com

    笔笔·bilibili视频批量下载助手 sends data to huoxiaqu.com. 6 other extensions we have analysed send data here.

Updated 15 October 2026pcincghmknikooegkfpgkfgedknmahgg