Is Convert WebP to PNG / JPG safe?

Medium risk

Convert WebP to PNG is medium risk. We observed the extension contact getcountry.cloudsearch.workers.dev during dynamic analysis; install/update events call the same lookup, fetching a country code, validating it, and storing it as userCountry for the conversion-limit logic.

WebP to PNGv3.0.17Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Install-time country lookup contacts Cloudsearch

We observed the extension contact getcountry.cloudsearch.workers.dev during dynamic analysis; install/update events call the same lookup, fetching a country code, validating it, and storing it as userCountry for the conversion-limit logic.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install or update the extension.

The install/update listener calls the country lookup during extension setup.

The extension did this

The extension contacts a Cloudsearch country service and saves the returned country code locally.

The request lets the remote service infer a country from the connection that reaches it; the code then stores the uppercase response as userCountry.

Captured request
GEThttps://getcountry.cloudsearch.workers.dev/

HTTP 200 observed during dynamic analysis; no request body was recorded.

Data used and stored by the lookup
  • Network location
    203.0.113.42 (illustrative IP address)

    The country service can estimate your country from the network request that reaches it.

  • Country code
    US (illustrative country code)

    The extension keeps this short country value and uses it when deciding whether the free conversion limit applies.

What's stored on your device

This lets the extension remember the country result after the install-time lookup and use it later for feature gating.

Location
chrome.storage.local key userCountry
Contents
The extension writes the uppercase country code returned by https://getcountry.cloudsearch.workers.dev/ to userCountry. The verification evidence did not record the exact country value.
The code that does this

The install/update handler calls the country lookup and stores the result

Readable version

Readable country lookup

assets/index.ts-CKVDYBtc.js
async function tr() {  const {    userCountry: l  } = await chrome.storage.local.get(["userCountry"]);  return l ? Qe.includes(l) : !1}async function qe() {  if (!await tr()) try {    const t = await fetch("https://getcountry.cloudsearch.workers.dev/", {      signal: AbortSignal.timeout(1e4)    });    if (!t.ok) throw new Error(`HTTP error! status: ${t.status}`);    const e = await t.text();    if (!e.length || e.length > 5 || !/^[A-Za-z]+$/.test(e)) throw new Error(`Invalid country code received: ${e}`);    await chrome.storage.local.set({      userCountry: e.toUpperCase()    })  } catch (t) {    console.log("Failed to fetch user country:", t), await chrome.storage.local.set({      userCountry: "RU"    })  }}

Readable install/update hook

assets/index.ts-CKVDYBtc.js
chrome.runtime.onInstalled.addListener(async l => {  switch (l.reason) {    case chrome.runtime.OnInstalledReason.INSTALL:      ys({        url: ws      }), chrome.runtime.setUninstallURL(xs), Ze({        isNewUser: !0      }), await qe();      break;    case chrome.runtime.OnInstalledReason.UPDATE:      await qe();      break  }});

Readable feature-gate use of stored country

assets/index.ts-CKVDYBtc.js
chrome.contextMenus.onClicked.addListener(async l => {  const {    menuItemId: t,    mediaType: e,    srcUrl: s  } = l;  if (t === "image-converter" && e === "image" && s) {    const {      convertedCount: i,      userCountry: r    } = await Ht(), {      state: a    } = await ds(["state"]);    Qe.includes(r) && i >= $e && !a?.purchase_status && a?.purchase_status !== "paid" ? ps() : sr(s)  }});
External service contacted for country lookup
    • getcountry.cloudsearch.workers.dev

    Receives the install/update country lookup request and returns the country code stored as userCountry.

Updated 21 September 2026egmjalgmmolinfenecmfaeognbjbiipi