Is b站视频下载助手 bilibili video downloader safe?
bilibili video downloader is high risk. On install, the extension generates a permanent browser ID and looks up your IP for location. These, plus browser type, OS, and language, go to an Alibaba Cloud log service on install, update, or Bilibili download, linked to your UUID.…
Who publishes itAllen Alexis - 3 other listings from the same operator, 2 of them carrying a finding
Allen Alexis - 3 other listings from the same operator, 2 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 61k+ users between them. 2 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
UUID, IP, and Geolocation Sent to Alibaba Cloud on Install and Download
On install, the extension generates a permanent browser ID and looks up your IP for location.
These, plus browser type, OS, and language, go to an Alibaba Cloud log service on install, update, or Bilibili download, linked to your UUID.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install or update the extension.
The onInstalled event fires immediately; no further interaction is required.
The extension generates or retrieves a permanent UUID for your browser, fetches your IP address and country from ipinfo.io, then sends the combined profile to Alibaba Cloud.
The same telemetry event is also sent each time you download a Bilibili video via the extension popup.
HTTP 200. Captured within 5 seconds of install during the dynamic analysis run.
- Content-Type
- application/x-protobuf
- x-log-apiversion
- 0.6.0
- x-log-bodyrawsize
- 320
{ "__logs__": [ { "extension_name": "bili_downloader", "version": "1.0.16", "user_ip": "82.3.220.102", "uuid": "cb121cfc-91f7-4dd4-89ff-989de7028888", "install_time": "1780615199", "event_time": "1780615200", "event_category": "install", "event_operate": "user_install", "event_tag": "1.0.16", "browser_type": "chrome", "operate_system": "Linux", "region": "United Kingdom", "language": "en-GB" } ]}- Persistent device IDcb121cfc-91f7-4dd4-89ff-989de7028888
A unique identifier generated for your browser on first install. It stays the same across sessions, linking every future event back to you.
- IP address82.3.220.102
Your public IP address at the time of the event, resolved via ipinfo.io or ip-api.com.
- CountryUnited Kingdom
Your country derived from the IP geolocation lookup.
- Operating systemLinux
The platform string detected from navigator.platform.
- Browser typechrome
Detected from the extension's homepage URL (chrome or edge).
- Install timestamp1780615199
Unix timestamp (seconds) of first install, stored permanently and sent with every event.
- Event category and actionevent_category=install, event_operate=user_install
The type of action that triggered the event, e.g. install, update, or download.
Telemetry assembly and dispatch in background.js
Event builder — readable form
js/background.js// SlsLogger config: Alibaba Cloud SLS, project=hawkeye-us, logstore=bili_downloader// count=1 means every event is flushed immediately (no batching)const slsConfig = { host: 'us-west-1.log.aliyuncs.com', project: 'hawkeye-us', logstore: 'bili_downloader', time: 0.05, count: 1};function sendTelemetryEvent(category, action, tag) { chrome.storage.local.get(['ipInfo', 'install_time', 'uid'], (stored) => { const record = { extension_name: 'bili_downloader', version: chrome.runtime.getManifest().version, user_ip: stored.ipInfo?.ip || stored.ipInfo?.query || '', uuid: stored.uid, // persistent UUID install_time: stored.install_time, event_time: Math.round(Date.now() / 1000).toString(), event_category: category || '', event_operate: action || '', event_tag: tag || '', browser_type: manifest.homepage_url.includes('chrome') ? 'chrome' : 'edge', operate_system: detectOS(), // navigator.platform region: stored.ipInfo?.country || '', language: chrome.i18n.getUILanguage() }; const logger = new SlsLogger(slsConfig); logger.send(record); // immediately POSTed to Alibaba Cloud });}- hawkeye-us.us-west-1.log.aliyuncs.com
Alibaba Cloud Log Service (SLS) logstore bili_downloader, project hawkeye-us. Receives UUID, IP, country, OS, browser type, and action events on install, update, and download.
- ipinfo.io
IP geolocation service. Queried on install to resolve public IP, city, country, region, and ISP. Full JSON response stored locally and referenced in all subsequent telemetry.
- ip-api.com
Fallback IP geolocation service. Queried when ipinfo.io returns a non-200 status.
Remote Config Pulled from twiclips.com on Install and Every Bilibili Page
On install, update, and each Bilibili page visit, the extension fetches a remote config from twiclips.com and stores it locally.
This config can change behavior anytime, without a Chrome Web Store update or Google review.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You navigate to any page on bilibili.com.
The content script fires a zbase-content-init message to the service worker on every matching page load.
The extension POSTs a request to twiclips.com to retrieve a remote configuration object, which is then saved locally and used to control extension behavior.
The same request also fires unconditionally on install and update.
Server returned status 0 (unreachable) during the dynamic analysis run. Two outbound POST requests captured (an observed event and event 766349.4). The hardcoded extension_id=11 was confirmed in both requests. No zbaseConfig written to storage (consistent with failed server response; storage write only occurs when response code === 100000).
- Content-Type
- application/x-www-form-urlencoded
extension_id=11Remote config fetch function and trigger points
Readable remote config function
js/background.jsconst REMOTE_CONFIG_URL = 'https://twiclips.com/user/api-chrome-extension/get-remote-config';const EXTENSION_ID = 11; // hardcoded; not the Chrome extension IDfunction fetchRemoteConfig(extensionId, configUrl) { const params = new URLSearchParams(); params.append('extension_id', extensionId); postForm(configUrl, params).then(response => { if (response['code'] === 100000) { // Store the full config object; controls extension behavior chrome.storage.local.set({ zbaseConfig: response }); } // Non-100000 responses are logged but ignored });}// Called on installif (reason === 'install') fetchRemoteConfig(EXTENSION_ID, REMOTE_CONFIG_URL);// Called on updateif (reason === 'update') fetchRemoteConfig(EXTENSION_ID, REMOTE_CONFIG_URL);// Called on every bilibili page loadif (message.zbaseType === 'zbase-content-init') fetchRemoteConfig(EXTENSION_ID, REMOTE_CONFIG_URL);- twiclips.com
Remote config server run by the developer. Receives hardcoded extension_id=11 per request; returns config stored as zbaseConfig that can alter behavior without a Store update.
IP Address and Geolocation Resolved via ipinfo.io on Every Install
On install, the extension contacts ipinfo.io (falling back to ip-api.com) for a geolocation record: city, region, country, ISP, GPS.
This is saved locally and embedded in telemetry sent to Alibaba Cloud, tying your location to your profile.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You install the extension for the first time.
The lookup runs only when ipInfo is not already cached in chrome.storage.local.
The extension fetches your IP and geolocation from ipinfo.io, caches the response locally, and uses it to populate the IP, country, and region fields in all later telemetry.
If ipinfo.io is unavailable, a fallback request goes to ip-api.com. Both endpoints return your city-level location, ISP, and coordinates.
HTTP 200. Returned JSON with ip, city, region, country, org, timezone, loc fields. Captured in the dynamic analysis run (the extension service worker, an observed event). Fallback GET to http://ip-api.com/json/ also fired (an observed event, HTTP 200).
Saved as ipInfo in chrome.storage.local after install: IP, city, region, country, ISP, GPS. Read on every telemetry event to Alibaba Cloud.
- Location
- chrome.storage.local key 'ipInfo'
{ "isp": "Virgin Media Limited", "lat": 50.8309, "lon": -0.1635, "city": "Hove", "query": "82.3.220.102", "region": "ENG", "status": "success", "country": "United Kingdom", "countryCode": "GB"}IP geolocation fetch in background.js onInstalled handler
Readable form
js/background.jsif (!stored.ipInfo) { // Primary: ipinfo.io let geoData = await fetch('https://ipinfo.io/json') .then(r => r.json()) .catch(() => ''); // Fallback: ip-api.com (if non-200 or error) if (geoData?.status !== 200) { geoData = await fetch('http://ip-api.com/json/') .then(r => r.json()) .catch(() => ''); } // Stored under 'ipInfo'; reused in all future telemetry events chrome.storage.local.set({ ipInfo: geoData });}- ipinfo.io
Primary IP geolocation service. Returns IP, city, region, country, org (ISP), timezone, and coordinates. Data stored locally and embedded in all Alibaba Cloud telemetry events.
- ip-api.com
Fallback geolocation service used when ipinfo.io is unavailable. Returns equivalent fields including ISP and GPS lat/lon.
What it can do
Permissions this extension asks for, as declared in version 1.0.16. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on bilibili.com
http://*.bilibili.com/* and 1 more
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab
Read and change cookies, including the ones that keep you signed in
cookies