Is ChatGPT File Uploader & Conversation Saver safe?
The extension sends YouTube Music track details to artwork.boidu.dev when animated art is enabled.
Its YouTube Music content scripts capture the current video ID, song, artist, duration, and album from player events and YouTube API responses. With animated art enabled by default, it sends those fields as query parameters to artwork.boidu.dev whenever the track changes.
Who publishes itfrancisrodney81 - 1 other listing from the same operator, 1 of them carrying a finding
francisrodney81 - 1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 3k+ users between them. 1 of them carries a finding.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
YouTube Music listening data sent to artwork.boidu.dev on every track change
When you play a song on YouTube Music with animated art on (the default setting), the extension sends the song title, artist, duration, and album to artwork.boidu.dev.
We observed this request in a live test session.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You play a song or switch tracks on music.youtube.com.
The extension's animated-art feature is on by default.
The extension sends the song title, artist, duration, and album to artwork.boidu.dev.
This happens automatically for every new track, with no prompt shown.
- Song titleANGLE ABOVE ME RUN RUN RIVER
The exact title of the track you're currently listening to.
- Artist nameDie WBL
The performer or channel name for the current track.
- Track duration243
The length of the track in seconds.
- Album nameANGLE ABOVE ME RUN RUN RIVER
The album the current track belongs to, read from YouTube Music's own internal API response.
503 (rate-limited) in this session; the metadata had already left the browser in the request URL by the time the server responded.
The function that builds and sends the request
async function fetchAnimatedArt(song, artist, durationSeconds, album, abortSignal) { const cacheKey = `bls_${artist}|${album}`; try { const cached = await cache.get(cacheKey); if (cached !== undefined) { if (typeof cached === "string") return cached; // cached video URL if (typeof cached === "object" && "notFoundAt" in cached) { const expired = Date.now() - cached.notFoundAt >= 6048e5; // 7 days if (!expired) return null; } } } catch (e) {} // Build the query string from the currently playing track's metadata // and send it to the third-party artwork host. const params = new URLSearchParams({ s: song, a: artist, d: Math.round(durationSeconds).toString(), al: album, }); const url = `https://artwork.boidu.dev?${params.toString()}`; try { const response = await fetch(url, { signal: abortSignal }); if (!response.ok) return null; const json = await response.json(); if (json.videoUrl) { await cache.set(cacheKey, json.videoUrl); } else { await cache.set(cacheKey, { notFoundAt: Date.now() }); } return json.videoUrl; } catch (e) { return null; }}- artwork.boidu.dev
Receives your currently-playing song title, artist, duration, and album on every track change to look up an animated background video.
Where it sends data
Destinations our analysis observed ChatGPT File Uploader & Conversation Saver contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- artwork.boidu.dev
ChatGPT File Uploader & Conversation Saver sends data to artwork.boidu.dev. One other extension we have analysed sends data here.