Is b站视频下载助手 bilibili video downloader safe?

High risk

bilibili video downloader is high risk. On install, the extension generates a permanent browser ID and looks up your IP for location. These, plus browser type, OS, and language, go to an Alibaba Cloud log service on install, update, or Bilibili download, linked to your UUID.…

Allen Alexisv1.0.16Chrome Web Store
77Risk
Who publishes it

Allen Alexis - 3 other listings from the same operator, 2 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Allen Alexis

Same store account

3 other listings published from this account, 61k+ users between them. 2 of them carry a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

UUID, IP, and Geolocation Sent to Alibaba Cloud on Install and Download

On install, the extension generates a permanent browser ID and looks up your IP for location.

These, plus browser type, OS, and language, go to an Alibaba Cloud log service on install, update, or Bilibili download, linked to your UUID.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install or update the extension.

The onInstalled event fires immediately; no further interaction is required.

The extension did this

The extension generates or retrieves a permanent UUID for your browser, fetches your IP address and country from ipinfo.io, then sends the combined profile to Alibaba Cloud.

The same telemetry event is also sent each time you download a Bilibili video via the extension popup.

Captured request
POSThttps://hawkeye-us.us-west-1.log.aliyuncs.com/logstores/bili_downloader/track

HTTP 200. Captured within 5 seconds of install during the dynamic analysis run.

Headers
Content-Type
application/x-protobuf
x-log-apiversion
0.6.0
x-log-bodyrawsize
320
Body
{  "__logs__": [    {      "extension_name": "bili_downloader",      "version": "1.0.16",      "user_ip": "82.3.220.102",      "uuid": "cb121cfc-91f7-4dd4-89ff-989de7028888",      "install_time": "1780615199",      "event_time": "1780615200",      "event_category": "install",      "event_operate": "user_install",      "event_tag": "1.0.16",      "browser_type": "chrome",      "operate_system": "Linux",      "region": "United Kingdom",      "language": "en-GB"    }  ]}
Fields included in every telemetry event
  • Persistent device ID
    cb121cfc-91f7-4dd4-89ff-989de7028888

    A unique identifier generated for your browser on first install. It stays the same across sessions, linking every future event back to you.

  • IP address
    82.3.220.102

    Your public IP address at the time of the event, resolved via ipinfo.io or ip-api.com.

  • Country
    United Kingdom

    Your country derived from the IP geolocation lookup.

  • Operating system
    Linux

    The platform string detected from navigator.platform.

  • Browser type
    chrome

    Detected from the extension's homepage URL (chrome or edge).

  • Install timestamp
    1780615199

    Unix timestamp (seconds) of first install, stored permanently and sent with every event.

  • Event category and action
    event_category=install, event_operate=user_install

    The type of action that triggered the event, e.g. install, update, or download.

The code that does this

Telemetry assembly and dispatch in background.js

Readable version

Event builder — readable form

js/background.js
// SlsLogger config: Alibaba Cloud SLS, project=hawkeye-us, logstore=bili_downloader// count=1 means every event is flushed immediately (no batching)const slsConfig = {  host: 'us-west-1.log.aliyuncs.com',  project: 'hawkeye-us',  logstore: 'bili_downloader',  time: 0.05,  count: 1};function sendTelemetryEvent(category, action, tag) {  chrome.storage.local.get(['ipInfo', 'install_time', 'uid'], (stored) => {    const record = {      extension_name: 'bili_downloader',      version: chrome.runtime.getManifest().version,      user_ip: stored.ipInfo?.ip || stored.ipInfo?.query || '',      uuid: stored.uid,                        // persistent UUID      install_time: stored.install_time,      event_time: Math.round(Date.now() / 1000).toString(),      event_category: category || '',      event_operate: action || '',      event_tag: tag || '',      browser_type: manifest.homepage_url.includes('chrome') ? 'chrome' : 'edge',      operate_system: detectOS(),              // navigator.platform      region: stored.ipInfo?.country || '',      language: chrome.i18n.getUILanguage()    };    const logger = new SlsLogger(slsConfig);    logger.send(record);  // immediately POSTed to Alibaba Cloud  });}
Data destinations
    • hawkeye-us.us-west-1.log.aliyuncs.com

    Alibaba Cloud Log Service (SLS) logstore bili_downloader, project hawkeye-us. Receives UUID, IP, country, OS, browser type, and action events on install, update, and download.

    • ipinfo.io

    IP geolocation service. Queried on install to resolve public IP, city, country, region, and ISP. Full JSON response stored locally and referenced in all subsequent telemetry.

    • ip-api.com

    Fallback IP geolocation service. Queried when ipinfo.io returns a non-200 status.

Remote Config Pulled from twiclips.com on Install and Every Bilibili Page

On install, update, and each Bilibili page visit, the extension fetches a remote config from twiclips.com and stores it locally.

This config can change behavior anytime, without a Chrome Web Store update or Google review.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any page on bilibili.com.

The content script fires a zbase-content-init message to the service worker on every matching page load.

The extension did this

The extension POSTs a request to twiclips.com to retrieve a remote configuration object, which is then saved locally and used to control extension behavior.

The same request also fires unconditionally on install and update.

Captured request
POSThttps://twiclips.com/user/api-chrome-extension/get-remote-config

Server returned status 0 (unreachable) during the dynamic analysis run. Two outbound POST requests captured (an observed event and event 766349.4). The hardcoded extension_id=11 was confirmed in both requests. No zbaseConfig written to storage (consistent with failed server response; storage write only occurs when response code === 100000).

Headers
Content-Type
application/x-www-form-urlencoded
Body
extension_id=11
The code that does this

Remote config fetch function and trigger points

Readable version

Readable remote config function

js/background.js
const REMOTE_CONFIG_URL = 'https://twiclips.com/user/api-chrome-extension/get-remote-config';const EXTENSION_ID = 11;  // hardcoded; not the Chrome extension IDfunction fetchRemoteConfig(extensionId, configUrl) {  const params = new URLSearchParams();  params.append('extension_id', extensionId);  postForm(configUrl, params).then(response => {    if (response['code'] === 100000) {      // Store the full config object; controls extension behavior      chrome.storage.local.set({ zbaseConfig: response });    }    // Non-100000 responses are logged but ignored  });}// Called on installif (reason === 'install') fetchRemoteConfig(EXTENSION_ID, REMOTE_CONFIG_URL);// Called on updateif (reason === 'update') fetchRemoteConfig(EXTENSION_ID, REMOTE_CONFIG_URL);// Called on every bilibili page loadif (message.zbaseType === 'zbase-content-init') fetchRemoteConfig(EXTENSION_ID, REMOTE_CONFIG_URL);
Remote config origin
    • twiclips.com

    Remote config server run by the developer. Receives hardcoded extension_id=11 per request; returns config stored as zbaseConfig that can alter behavior without a Store update.

IP Address and Geolocation Resolved via ipinfo.io on Every Install

On install, the extension contacts ipinfo.io (falling back to ip-api.com) for a geolocation record: city, region, country, ISP, GPS.

This is saved locally and embedded in telemetry sent to Alibaba Cloud, tying your location to your profile.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You install the extension for the first time.

The lookup runs only when ipInfo is not already cached in chrome.storage.local.

The extension did this

The extension fetches your IP and geolocation from ipinfo.io, caches the response locally, and uses it to populate the IP, country, and region fields in all later telemetry.

If ipinfo.io is unavailable, a fallback request goes to ip-api.com. Both endpoints return your city-level location, ISP, and coordinates.

Captured request
GEThttps://ipinfo.io/json

HTTP 200. Returned JSON with ip, city, region, country, org, timezone, loc fields. Captured in the dynamic analysis run (the extension service worker, an observed event). Fallback GET to http://ip-api.com/json/ also fired (an observed event, HTTP 200).

What's stored on your device

Saved as ipInfo in chrome.storage.local after install: IP, city, region, country, ISP, GPS. Read on every telemetry event to Alibaba Cloud.

Location
chrome.storage.local key 'ipInfo'
Contents
{  "isp": "Virgin Media Limited",  "lat": 50.8309,  "lon": -0.1635,  "city": "Hove",  "query": "82.3.220.102",  "region": "ENG",  "status": "success",  "country": "United Kingdom",  "countryCode": "GB"}
The code that does this

IP geolocation fetch in background.js onInstalled handler

Readable version

Readable form

js/background.js
if (!stored.ipInfo) {  // Primary: ipinfo.io  let geoData = await fetch('https://ipinfo.io/json')    .then(r => r.json())    .catch(() => '');  // Fallback: ip-api.com (if non-200 or error)  if (geoData?.status !== 200) {    geoData = await fetch('http://ip-api.com/json/')      .then(r => r.json())      .catch(() => '');  }  // Stored under 'ipInfo'; reused in all future telemetry events  chrome.storage.local.set({ ipInfo: geoData });}
Geolocation providers contacted
    • ipinfo.io

    Primary IP geolocation service. Returns IP, city, region, country, org (ISP), timezone, and coordinates. Data stored locally and embedded in all Alibaba Cloud telemetry events.

    • ip-api.com

    Fallback geolocation service used when ipinfo.io is unavailable. Returns equivalent fields including ISP and GPS lat/lon.

What it can do

Permissions this extension asks for, as declared in version 1.0.16. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on bilibili.com

    http://*.bilibili.com/* and 1 more

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

  • Read and change cookies, including the ones that keep you signed in

    cookies

Updated 30 September 2026pamdgobbggbpfpnadidipelihgkafiid