Is EasyKOL: Find Similar Creators on YouTube, TikTok & Instagram safe?

Medium risk

EasyKOL intercepts Instagram and TikTok API responses to collect creator profile, post, video, and hashtag metrics.

When you browse supported Instagram or TikTok pages, EasyKOL replaces XMLHttpRequest or fetch and copies data from profile, post, reel, tagged-post, and hashtag responses. The collected data includes URLs, biographies and bio links, engagement counts, video descriptions, mentions, paid-partnership/shop flags, and music metadata, then stores it in sessionStorage and passes it back to the extension to calculate displayed creator statistics.

EasyKOLv4.5.2Chrome Web Store

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

EasyKOL logs every Instagram, TikTok, and YouTube creator page you open

EasyKOL's KolBrowseHistory script runs on every Instagram, TikTok, and YouTube page you visit.

It reports the profile to EasyKOL's backend even if you never use the extension's creator search feature.

Severity: Medium unwanted
Type: Unexpected
CWE: CWE-359
Source: Dynamic sandbox

What actually happens

You did this

The user visits a public Instagram, TikTok, or YouTube creator profile during normal browsing.

No search, no 'find similar creators' click, and no other extension UI interaction is involved.

The extension did this

The extension resolves the creator's platform id and handle from the page and sends them to EasyKOL's backend.

This happens on the very first load of the page and again on every in-app navigation to a new profile.

Captured request

POSThttps://app.easykol.com/api/kols/browse-history

401 Unauthorized in this test session because the test account was not signed in to EasyKOL; the extension sent the report regardless of authentication state.

Body

{  "platform": "INSTAGRAM",  "platformUserId": "528817151",  "handler": "nasa"}

When this fires

Every 1 second

Beyond the initial page load, the content script polls location.href every second and listens for tab visibility changes, re-running the report for any new profile it detects, all without a page refresh.

What KolBrowseHistory.js sends on every profile visit

Platform
INSTAGRAM
Which site the profile page belongs to.
Creator's platform user id
528817151
The stable numeric or alphanumeric id the platform assigns that creator's account.
Creator's handle
nasa
The @handle or channel name shown on the profile page.

Where every profile visit is reported

- app.easykol.com
EasyKOL's own backend. Receives the platform, creator id, and handle for every profile page visited, independent of any explicit creator-search action.