Is DeleteTweets - Bulk Delete Tweets safe?
DeleteTweets is high risk. Tweet deletion or backup telemetry adds the email from the sync profile before sending via Alibaba ARMS. Testing saw telemetry to arms-retcode.aliyuncs.com/r.png, but the X workflow for the email event was unavailable.
Who publishes itLive Polls - 10 other listings from the same operator, none carrying a finding
Live Polls - 10 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
10 other listings published from this account, 79k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Profile email is attached to Alibaba ARMS telemetry
Tweet deletion or backup telemetry adds the email from the sync profile before sending via Alibaba ARMS.
Testing saw telemetry to arms-retcode.aliyuncs.com/r.png, but the X workflow for the email event was unavailable.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You start the extension's tweet deletion or backup workflow.
The background script routes the active X tab to action URLs such as https://x.com/home?action_type=toProfile or https://x.com/home?action_type=toBackup.
The extension prepares telemetry for that workflow and adds the stored profile email to the event.
The helper named Ot reads chrome.storage.sync key user and copies user.profile.email into the event object before calling the ARMS error API.
- Your account emailalex.chen@example.com (illustrative)
Connects a telemetry event to the email address saved in the extension profile.
- Workflow pagehttps://x.com/home?action_type=toProfile
Shows that the event is tied to the X page used for deletion or backup actions.
- Workflow event namestartDelete
Shows which part of the delete or backup process produced the telemetry event.
- Deletion request status200
Adds the result of an X deletion request to the same event that receives the email field.
Observed ARMS telemetry traffic reached Alibaba infrastructure. The recorded request summary was t=pv/health with anonymous uid/sid/pid and no email field during unauthenticated navigation.
The helper that adds the profile email before sending ARMS telemetry
Readable helper in deobfuscated content.js
content.js:27054-27065function Ot(e, t) { chrome.storage.sync.get(["user"]).then(async r => { var i; const n = r && r.user || null, a = ((i = n == null ? void 0 : n.profile) == null ? void 0 : i.email) || ""; e.email = a, window.__bl && __bl.error(new Error(JSON.stringify(e)), { filename: t, lineno: 384, colno: 18 }) })}Readable ARMS initialization in deobfuscated content.js
content.js:29821-29833const XF = function() { return rg.exports.singleton({ pid: "aa9hucpddy@1e275d6899570d8", appType: "web", imgUrl: "https://arms-retcode.aliyuncs.com/r.png?", autoSendPv: !0, behavior: !0, enableConsole: !0, sample: 10, release: "1.0" })};window.__bl = XF();- arms-retcode.aliyuncs.com
Alibaba Cloud ARMS browser-monitoring endpoint configured by the bundled SDK and observed during dynamic analysis.
What it can do
Permissions this extension asks for, as declared in version 2.3.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on twitter.com
*://*.twitter.com/*
Read and change your data on x.com
*://*.x.com/*
Store data in your browser
storage