Is DeepSeek AI Image Generator safe?

Medium risk

DeepSeek AI Image Generator is medium risk. Code analysis shows each generation passes your prompt, reference image and account email into an Alibaba ARMS logger that reports to arms-retcode.aliyuncs.com, with 10% sampling.

yichongv2.3.6Chrome Web Store
45Risk
Who publishes it

yichong - 11 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
yichong

Same store account

11 other listings published from this account, 1k+ users between them, none of them carrying a finding.

Doc Edit Replay - AI Detector & Originality Checker for Google Docs355CleanAI Wallpaper Maker241CleanAI Quiz Generator - Instant Assessment Quiz Builder217CleanAI Coloring Pages Generator - Unleash Your Creativity107CleanHandwritten to Text91CleanFlipbook Maker35Clean5 more listings in the relationship graph, on paid plans →

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

AI image extension sends prompts, images and Google email to Alibaba ARMS

Code analysis shows each generation passes your prompt, reference image and account email into an Alibaba ARMS logger that reports to arms-retcode.aliyuncs.com, with 10% sampling.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You press Generate after typing a prompt.

This happens on every generation while signed in.

The extension did this

The extension hands your prompt, reference image and account email to a telemetry logger.

The logger reports to an Alibaba ARMS endpoint.

The code that does this

Logger wrapper and the call carrying user data

Readable version

st() wrapper

index.js
function logEvent(payload, label) {  if (window.__bl) __bl.error(new Error(JSON.stringify(payload)), { filename: label });}

Generate request call

index.js
logEvent({  AppType: mode,  prompt: promptText,  mapImg: referenceImage,  email: window.userStatus.email}, 'generate request (label in Chinese)');

Logger initialisation

index.js
__bl = singleton({ pid: 'aa9hucpddy@5645567688c8f67', imgUrl: 'https://arms-retcode.aliyuncs.com/r.png?', behavior: true, enableConsole: true, sample: 10 });
Fields passed to the logger on a generation request
  • Your prompt
    a watercolor fox in a snowy forest

    The text you typed into the generator.

  • Reference image
    https://statics.imgkits.com/upload/1727800000_ab12.jpg

    The first image you selected as input, as a URL or data value.

  • Your account email
    jane.doe@example.com (illustrative)

    Email from the extension's login state, tying the report to you.

  • Mode
    text-to-image

    Which generator mode you used.

Where the data goes
    • arms-retcode.aliyuncs.com

    Alibaba ARMS BrowserLogger collection endpoint receiving r.png beacons with the serialised report.

    • www.livepolls.app

    Vendor backend; separately receives the email (email-collect) and Google profile id (passport) on login.

Check if you're affected

Lists the logger calls that include the email field and the ARMS endpoint in the shipped script.

Requires
  • POSIX shell
  • grep
find_arms_logging.sh · sh
#!/bin/sh# Run in the unpacked extension directorygrep -o 'st({AppType:[^)]*email:[^)]*)' index.js | headgrep -o 'imgUrl:"https://arms-retcode[^"]*"' index.js
How to run it
  1. 1Unpack extension lbbiellcngichdcjlidijooflbfgafif version 2.3.
  2. 2
  3. 3cd into the folder.
  4. 4Run the script.
  5. 5Output shows st() calls carrying email and the ARMS beacon URL.
Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

What it can do

Permissions this extension asks for, as declared in version 2.3.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Add items to the right-click menu

    contextMenus

  • Store data in your browser

    storage

  • Sign you in with your Google account

    identity

  • See the email address of your Google account

    identity.email

Updated 15 October 2026lbbiellcngichdcjlidijooflbfgafif