Is Image Downloader Assistant - Batch Save Images safe?
Image Downloader Assistant bundles the Mellowtel SDK, which loads server-chosen pages in hidden frames and uploads their content.
The extension includes the Mellowtel SDK, which opens a persistent connection to ws.mellow.tel and receives crawl jobs. Each job loads a URL chosen by the server in a hidden frame or tab using the user's IP address, then uploads the rendered page HTML and content to Mellowtel-run AWS endpoints. Jobs can also load a bundled script that records XMLHttpRequest headers, bodies and responses and sends them to an endpoint the job specifies.
Who publishes itsiegeappbrasil - 11 other listings from the same operator, 10 of them carrying a finding
siegeappbrasil - 11 other listings from the same operator, 10 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
11 other listings published from this account, 1k+ users between them. 10 of them carry a finding.
Shared hosts - 2 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Mellowtel job frames load an XHR recorder that reports request and response bodi
Code analysis shows a web-accessible script can hook XMLHttpRequest in job frames and post captured requests and responses to a server-named endpoint.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
Opts in at mellow.tel while the service keeps its WebSocket open.
A server job can load meucci.js in a job frame so XHR traffic there is recorded and sent to the job's api_endpoint.
XHR hook and result post
Result post
meucci.jsfunction saveResult(info) { window.parent.postMessage({isBurkeProcessed:true, recordID:info.id, resultToSave:JSON.stringify(info), apiEndpoint:config.api_endpoint, type:'saveBurkeResult'}, '*');}XHR send hook
meucci.js// on send: store sentData; on load: store status, responseHeaders, responseText and parsed JSONXMLHttpRequest.prototype.send = function (body) { info.sentData = body; this.addEventListener('load', () => { info.responseData = this.responseText; ... saveResult(info); }); }- Request URLhttps://example.com/api/cart?id=88
The address each in-frame request was sent to.
- Request headers
Headers set on each request, which can include tokens.
- Request body{"qty":2}
Whatever the page sent in the request.
- Response body{"status":"ok"}
The text returned by the server for that request.
The hook runs in frames the SDK opens for remote jobs, not in the user's own tabs, and requires opt-in plus a server job that enables it.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Mellowtel SDK opens a server-driven crawl channel and uploads page HTML
Code analysis shows a bundled SDK, after opt-in, opens a WebSocket and loads server-chosen URLs in off-screen frames, uploading the page HTML to AWS Lambda endpoints.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Static analysis
Installs the extension and completes the mellow.tel opt-in page.
The worker contacts api.mellow.tel/approval, opens wss://ws.mellow.tel and waits for crawl jobs.
WebSocket endpoint and HTML upload call
Endpoint constants
background.js// WebSocket for server jobsconst WS_URL = 'wss://ws.mellow.tel';const APPROVAL_URL = 'https://api.mellow.tel/approval';HTML upload
background.js// POST the loaded page's URL and HTML to a Lambda function URLfetch('https://<id>.lambda-url.us-east-1.on.aws/', {method:'POST', body: JSON.stringify({url, htmlContent, orgId})})- Page URLhttps://example.com/products/1042
Tells the service which page was loaded in the job frame.
- Page HTML<html><head><title>Product 1042</title>...
The full rendered page of the loaded URL is sent to the service.
- Organisation ID1448c4f8
Identifies the SDK account the job belongs to.
- ws.mellow.tel
WebSocket that delivers crawl jobs to the device.
- api.mellow.tel
Approval check before the WebSocket opens.
- *.lambda-url.us-east-1.on.aws
AWS Lambda endpoints that receive page HTML and job status.
Gated on the mellow.tel opt-in. Jobs load server-chosen URLs, not the user's own tabs, though credentialed frames may carry cookies.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
Where it sends data
Destinations our analysis observed Image Downloader Assistant - Batch Save Images contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ws.mellow.tel
Image Downloader Assistant - Batch Save Images sends data to ws.mellow.tel. 20 other extensions we have analysed send data here.
- api.mellow.tel
Image Downloader Assistant - Batch Save Images sends data to api.mellow.tel. 13 other extensions we have analysed send data here.
- Mellowtel AWS Lambda endpoints (us-east-1.on.aws)
Image Downloader Assistant - Batch Save Images sends data to Mellowtel AWS Lambda endpoints (us-east-1.on.aws). Named as a recipient in this extension's own analysis.