Is Custom Progress Bar for YouTube™ safe?
Custom Progress Bar for YouTube is medium risk. On install, background.js generates and permanently stores a random ID. A 'notification' alarm fires every 5 min (12-hour delay), sending that ID and runtime ID to custom-progressbar.com/api/notification/. A planted marker confirmed this.
Who publishes itClean Iron - 2 other listings from the same operator, none carrying a finding
Clean Iron - 2 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 8k+ users between them, none of them carrying a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
A Permanent Install ID Is Sent to the Developer Every 5 Minutes
On install, background.js generates and permanently stores a random ID.
A 'notification' alarm fires every 5 min (12-hour delay), sending that ID and runtime ID to custom-progressbar.com/api/notification/.
A planted marker confirmed this.
What actually happens
You install the extension. No further action is needed – its background service worker keeps running.
Every 5 minutes, the extension sends a GET request to custom-progressbar.com carrying a random ID that was generated once at install and never changes.
We forced the extension's own recurring alarm to fire and observed the request leave with the ID attached.
When this fires
Every 5 minutes
Starting 12 hours after install, the extension polls custom-progressbar.com/api/notification/ every 5 minutes for as long as the browser and extension keep running, attaching the same permanent ID each time.
The code that does this
The ID is generated once at install, then read back and sent out on every alarm fire
ID generated once, at install
chrome.storage.local.set({ style: chrome.runtime.getURL("assets/css/style.css"), uid: Math.floor(Math.random() * Math.floor(Math.random() * Date.now())), extId: chrome.runtime.id, is_enable: true, current: getDefaultStyle(), styles: [], isChromeBottomVisible: false, c: 0, dateinstall: (new Date).getTime(), collections: STARTER_COLLECTIONS, version: "4.0.0",});The recurring alarm that reads the ID back and sends it out
chrome.alarms.create("notification", { delayInMinutes: 720, periodInMinutes: 5 });chrome.alarms.onAlarm.addListener(async (alarm) => { if (alarm.name !== "notification") return; try { const { uid } = await storageGet(["uid"]); const url = new URL(notificationEndpoint()); // https://custom-progressbar.com/api/notification/?ext=<runtime id> if (uid) url.searchParams.set("uid", uid); const res = await fetch(url.toString()); const data = await res.json(); if (data && data.notifications) { await storageSet({ notifications: data.notifications }); } } catch (e) { console.error("Error fetching notifications:", e); }});Captured request
The endpoint answered with an HTTP 404/308 in our test session – a server-side response detail that doesn't affect the finding, which is that the request (with the permanent ID attached) leaves the device on schedule.
What custom-progressbar.com receives on every 5-minute poll
- Permanent install IDuid=918273645 (illustrative -- a large random integer generated once at install)
A number generated once at install and never rotated; the same value is sent every 5 minutes for as long as the extension stays installed.
- Extension runtime IDext=nbkomboflhdlliegkaiepilnfmophgfg
Chrome's internal ID for this extension install, sent alongside the permanent ID.