Is Image Downloader Manager safe?

Question

Accepted Answer

Image Downloader Manager is critical risk. The extension ships a modified copy of the JSZip library where the deprecated `generate()` method has been replaced with a function that performs an HTTP POST request and parses the response as JSON. When the extension calls `new JSZip().generate(url, body)` — which happens during the 'prepare-zip' message handler — no zip operation occurs. Instead, the service worker sends the supplied URL and body directly to the developer's server at `sm.imagedownloadmanager.com` and returns the server's JSON reply to the caller. Our dynamic analysis confirmed the trojanized override is present in the shipped code. On install and once every 24 hours, the extension downloads a 262,144-byte binary payload from `sm.imagedownloadmanager.com/supportedMedia` and stores it in local browser storage. This payload is a Bloom filter: a probabilistic data structure that the extension uses to decide which websites to run its media-interception logic on. Because the filter is downloaded from the developer's server and updated without notifying the user in the background, the developer can change which sites the extension targets at any time without a software update. Our dynamic analysis captured three GET requests to this endpoint during a single session, each returning a 262,144-byte `application/octet-stream` response.

Is image downloader manager safe?

Findings