Is Discord Token Login safe?

Medium risk

Discord Token Login sends paste-event telemetry with the active tab hostname and field tag to its analytics proxy.

When paste handling is enabled, the extension records paste start and completion events from pages where its content script runs. On paste completion, it sends the active tab hostname, field tag, paste count bucket, persistent client and session IDs, and an install token to its analytics proxy.

Meta Infinityv2.5.5Chrome Web Store
45Risk
Who publishes it

Meta Infinity - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Meta Infinity
Website
mitool.io

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Paste events send active site details to analytics proxy

When you paste into a page, the extension records the active tab hostname and the focused field tag.

It sends that paste event to the extension analytics proxy with persistent client and session identifiers and an install bearer token.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You paste into a web page while the extension's paste feature is enabled.

The extension did this

The extension sends the active tab hostname and focused field tag to its analytics proxy.

Captured request
POSTasia-south1-extensions-analytics-prod.cloudfunctions.net/extensions-ga-proxy/v1/collect
Fields in the request
  • Active tab URL
    https://example.com/account (illustrative)

    Shows which site was open when the paste action happened.

  • Browsing history context
    example.com (illustrative)

    Links the paste event to a site visit in your browsing activity.

Where it sends data

Destinations our analysis observed Discord Token Login contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • asia-south1-extensions-analytics-prod.cloudfunctions.net

    Discord Token Login sends data to asia-south1-extensions-analytics-prod.cloudfunctions.net. 2 other extensions we have analysed send data here.

Updated 30 September 2026pdmpkpjlmnndlfdllmnekbmgjikhghjg