Is Etsy Downloader - Download Videos & Images safe?

Medium risk

Etsy Downloader sends Etsy page URLs and search terms to Aliyun Logs when download controls are used.

When you use the extension on Etsy, it records telemetry around download actions and includes the current Etsy page URL. On Etsy search result pages, the logged data can include the search term from the page URL, along with browser details such as user agent, language, and referrer.

Caller Caov1.0.0.1Chrome Web Store
45Risk
Who publishes it

Caller Cao - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Caller Cao

Same store account

1 other listing published from this account, 3k+ users between them, none of them carrying a finding.

YouTube Comment Summary with ChatGPT OpenAI3k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Etsy download clicks send page and search telemetry to Aliyun Logs.

When you use Etsy Downloader, download clicks can send the Etsy page URL, referrer, browser header values, and storage identifiers to an Aliyun Logs endpoint.

Search-result clicks also include the Etsy search term from the page URL.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You click download-related controls while browsing Etsy.

The extension did this

The extension records Etsy page context, search-term telemetry, browser header values, and stored identifiers, then sends the telemetry to Aliyun Logs.

Captured request
POSThttps://nc-dn-us.us-west-1.log.aliyuncs.com/logstores/extensions/track
Fields in the request
  • Etsy page URL
    https://www.etsy.com/search?q=vintage+print (illustrative)

    Shows which Etsy page was open when the download action occurred, including search-result page context.

  • Referrer page
    https://www.etsy.com/listing/123456789/sample-item (illustrative)

    Carries the current Etsy page URL as referrer context for the telemetry event.

  • Extension storage identifier
    d7f3a1b2-4c5d-6789-abcd-0123456789ef (illustrative)

    Links events using an anonymous user identifier stored by the extension.

  • Browser header values
    Mozilla/5.0; en-US,en;q=0.9 (illustrative)

    Includes browser context such as user agent and accepted language.

What it can do

Permissions this extension asks for, as declared in version 1.0.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Start, monitor and manage your downloads

    downloads

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Etsy Downloader - Download Videos & Images contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • nc-dn-us.us-west-1.log.aliyuncs.com

    Etsy Downloader - Download Videos & Images sends data to nc-dn-us.us-west-1.log.aliyuncs.com. 7 other extensions we have analysed send data here.

Updated 30 September 2026bcoflheaejlhhhcemjdkacefpepddljn