Is fjfclchn safe?

High risk

fjfclchn is high risk. On first install, the extension generates a 16-char ID stored permanently in local storage; it never changes. Every record sent to the developer's server carries this ID in 'uid', letting the developer link your full browsing history.…

75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Extension Assigns Each Browser a Persistent Tracking ID Sent With Every Request

On first install, the extension generates a 16-char ID stored permanently in local storage; it never changes.

Every record sent to the developer's server carries this ID in 'uid', letting the developer link your full browsing history.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install the extension for the first time.

background.js runs on browser startup and checks whether a tracking ID has already been created.

The extension did this

The extension automatically generates a unique identifier and stores it permanently so it can be attached to every future browsing record.

The same ID appears in every POST to service.download-all-pdfs.com/check_links for the lifetime of the installation.

02EvidenceSTORAGE DUMP
What's stored on your device

This 16-char value is your browser's permanent ID, from live DA, unchanged across all three POSTs to service.download-all-pdfs.com.

Locationchrome.storage.local key 'dapClientId'
Contents (JSON)
{
  "dapClientId": "19d9e4a12c10689e"
}
03EvidenceCODE COMPARE
The code that does this

Tracking ID generation and persistence (background.js function B/U)

What it actually does
async function getOrCreateTrackingId() {
  const stored = await chrome.storage.local.get(['dapClientId']);
  const existing = stored['dapClientId'];
  if (existing && typeof existing === 'string') {
    return existing;  // reuse the existing persistent ID
  }
  // Generate new 16-char hex ID from timestamp + random
  const newId = (Date.now().toString(16) + Math.random().toString(16).substring(2)).substring(0, 16);
  await chrome.storage.local.set({ dapClientId: newId });
  return newId;
}
04EvidenceNETWORK CAPTURE
Captured request
POSThttps://service.download-all-pdfs.com/check_links
Same uid value (19d9e4a12c10689e) present in all three captured POSTs across different pages and navigations, confirming the ID is stable.
Headers
Content-Typeapplication/json
Body
{
  "m": "do-ch",
  "uid": "19d9e4a12c10689e",
  "ev": "2.0.0",
  "ct": "text/html",
  "t": 1776477288604,
  "nm": "url_rewrite",
  "nt": "foreground",
  "u": "https://www.amazon.com/",
  "r": "https://www.amazon.com/",
  "links": []
}
SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

PDF Downloader Sends Full Browsing History to Remote Server on Every Page Visit

Every time you visit a page, Download All PDFs collects the URL, referrer, content type, and PDF links found, plus a persistent tracking ID, and POSTs this to the developer's server on all pages, not just where you use the PDF feature.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate to any web page.

The extension's content script is active on all HTTP and HTTPS pages by manifest declaration.

The extension did this

The extension transmits the page URL, referrer, content type, and PDF links to service.download-all-pdfs.com.

This happens automatically 300 ms after the page loads, regardless of whether you use the PDF download feature.

02EvidenceNETWORK CAPTURE
Captured request
POSThttps://service.download-all-pdfs.com/check_links
Server returns JSON with bad_links and unknown_links arrays.
Headers
Content-Typeapplication/json
Body
{
  "m": "do-ch",
  "uid": "19d9e4a12c10689e",
  "ev": "2.0.0",
  "ct": "text/html",
  "t": 1776477287315,
  "nm": "request",
  "nt": "foreground",
  "u": "https://www.amazon.com/",
  "r": "https://www.google.com/",
  "links": []
}
03EvidenceFIELD TABLE
Fields transmitted to service.download-all-pdfs.com in every POST
FieldValueWhy it matters
Page URL
https://www.amazon.com/gp/cart/view.html?ref_=nav_cartThe full address of every page you visit, including query parameters that may hold search terms, session tokens, or account identifiers.
Referrer URL
https://www.google.com/search?q=amazon+dealsThe address of the previous page you were on, revealing your navigation path and linking consecutive visits together.
Persistent tracking ID
19d9e4a12c10689eA unique identifier generated on first install and stored permanently. It ties every browsing record back to your browser across sessions.
Content type
text/htmlThe MIME type of the page (e.g. text/html, application/pdf), indicating what kind of content you are viewing.
Extension version
2.0.0The installed version of the extension, sent with every request.
PDF links on page
["https://example.com/annual-report-2025.pdf"]Up to 500 URLs of PDF files detected on the page, revealing what documents are available at the sites you visit.
04EvidenceCODE COMPARE
The code that does this

Message dispatch in content.js (the data collection call)

What it actually does
chrome.runtime.sendMessage({
  action: 'dap-collect',
  u: location.href,           // current page URL
  ct: document.contentType || 'text/html',
  r: referrer || document.referrer || '',
  links: pdfLinks,            // up to 500 PDF URLs from page
  isDynamic: isSpaNavigation
});
05EvidenceCODE COMPARE
The code that does this

Payload assembly and POST in background.js (function W / Y in deobfuscated source)

What it actually does
const payload = {
  m: 'do-ch',
  uid: dapClientId,       // persistent 16-char hex tracking ID
  ev: manifest.version,
  ct: contentType,
  t: Date.now(),
  nm: isDynamic || referrer ? 'url_rewrite' : 'request',
  nt: 'foreground',
  u: pageUrl,
  r: referrer,
  links: pdfLinks
};
await enqueueAndPost(payload);
await fetch('https://service.download-all-pdfs.com/check_links', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(payload)
});
06EvidenceTHIRD PARTY LIST
Destination receiving browsing history data
  • service.download-all-pdfs.com

    Receives a POST containing the page URL, referrer, content type, persistent user ID, and PDF links for every page navigation. Operated by the Download All PDFs extension developer.

SeverityHIGH
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Extension Polls Every 800ms to Capture and Transmit In-Page Navigation Events

The extension polls every 800ms for URL changes, including hash/history-API navigation in single-page apps.

On change it sends the new and prior URL as referrer to the developer's server; busy sites can trigger dozens of sends per session.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You navigate within a single-page application (e.g. clicking between pages on a social media or productivity site).

The URL changes without a full page reload, using the History API, hash fragments, or popstate events.

The extension did this

The extension captures the new URL and your previous location and transmits both to the developer's server within 800 ms.

The polling loop catches the URL change, packages the old URL as a referrer, and triggers a POST to service.download-all-pdfs.com/check_links.

02EvidenceTEMPORAL PATTERN
When this fires
Every 0.8 seconds

Polls location.href every 800 milliseconds while any HTTP/HTTPS page is open, transmitting a data record to service.download-all-pdfs.com whenever the URL changes.

03EvidenceCODE COMPARE
The code that does this

Polling loop and SPA navigation listeners in content.js

What it actually does
// Navigation change detector — fires every 800ms and on popstate/hashchange
function checkForNavigation() {
  const currentUrl = location.href;
  if (currentUrl === cachedUrl) return; // no change
  const previousUrl = cachedUrl;
  cachedUrl = currentUrl;
  sendCollectionMessage(previousUrl, /*isDynamic=*/true);
}

// Set up continuous polling and SPA event listeners
setInterval(checkForNavigation, 800);
window.addEventListener('popstate', checkForNavigation);
window.addEventListener('hashchange', checkForNavigation);
04EvidenceNETWORK CAPTURE
Captured request
POSThttps://service.download-all-pdfs.com/check_links
Second POST fired 1289ms after the first on the same amazon.com page navigation, confirming the 800ms polling loop fires on in-page URL changes. nm=url_rewrite signals an SPA/polling-triggered event vs the initial nm=request.
Headers
Content-Typeapplication/json
Body
{
  "m": "do-ch",
  "uid": "19d9e4a12c10689e",
  "ev": "2.0.0",
  "ct": "text/html",
  "t": 1776477288604,
  "nm": "url_rewrite",
  "nt": "foreground",
  "u": "https://www.amazon.com/",
  "r": "https://www.amazon.com/",
  "links": []
}
Updated 10 September 2026fjfclchnmkilojpjkfhngijlomhnendk