Is Image Downloader Pro —— Image DP safe?

Medium risk

Image Downloader Pro sends install and update telemetry with the active tab URL, public IP, and a persistent UUID to Aliyun SLS.

When the extension is installed or updated, its background script queries the active tab and sends telemetry that includes the current URL, public IP address, stored UUID, OS, language, install time, and extension version. The log is posted to an Aliyun SLS endpoint for the extension's image-downloader-pro logstore.

zf.extension.ai.paiv1.0.5Chrome Web Store
49Risk
Who publishes it

zf.extension.ai.pai - 3 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
zf.extension.ai.pai

Same store account

3 other listings published from this account, 16k+ users between them, none of them carrying a finding.

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Image Downloader Pro sends your tab URL, IP, and device ID on every install

On install or update, Image Downloader Pro sends the URL of your active tab, your public IP, and a persistent device ID to Aliyun's logging service, without a consent prompt.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install Image Downloader Pro, or it updates automatically.

No interaction with the extension's popup or the page is needed.

The extension did this

The background service worker sends the URL of your currently active tab, your public IP, and a persistent device ID to Aliyun's logging service.

The record also carries your OS, browser language, and approximate country.

Fields in the install/update telemetry record
  • Page you were on
    https://www.example.com/checkout/cart

    The full URL of your active browser tab at the moment the extension installs or updates.

  • Public IP address
    187.40.254.11

    Your IP address, fetched from a geolocation lookup right before this event is sent.

  • Device ID
    188dad9b-23b1-4843-aec0-c969c7ef0790

    A UUID created on first install and reused forever, letting Aliyun tie every future event back to this browser.

  • Approximate country
    BR

    Your country, derived from the IP geolocation lookup.

  • Browser language
    en-US

    Your browser's UI language setting.

Captured request
POSThttps://pai-us.us-west-1.log.aliyuncs.com/logstores/image-downloader-pro/track

200 OK. Observed during dynamic analysis immediately after the install event fired.

Headers
Content-Type
application/x-protobuf
x-log-apiversion
0.6.0
Body
{  "__logs__": [    {      "extension_name": "image-downloader-pro",      "version": "1.0.5",      "user_ip": "187.40.254.11",      "uuid": "188dad9b-23b1-4843-aec0-c969c7ef0790",      "install_time": "1757375000",      "event_time": "1757375003",      "event_category": "image-downloader-pro",      "event_operate": "user_install",      "event_tag": "1.0.5",      "browser_type": "chrome",      "operate_system": "other",      "region": "BR",      "language": "en-US",      "url": "https://www.example.com/checkout/cart"    }  ]}
The code that does this

Building and sending the telemetry record in background.js

Readable version

Assembles the record from the active tab and cached IP info, fires on install/update

js/background.js
function sendTelemetry(category, operate, tag) {  chrome.tabs.query({ active: true, currentWindow: true }, tabs => {    chrome.storage.local.get(["ipInfo", "install_time", "uid"], stored => {      let record = {        extension_name: "image-downloader-pro",        version: chrome.runtime.getManifest().version,        user_ip: stored.ipInfo?.ip || stored.ipInfo?.query || "",        uuid: stored.uid,        install_time: stored.install_time,        event_time: Math.round(new Date().getTime() / 1e3).toString(),        event_category: category || "",        event_operate: operate || "",        event_tag: tag || "",        browser_type: chrome.runtime.getManifest().homepage_url.includes("chrome") ? "chrome" : "edge",        operate_system: detectOS(),        region: stored.ipInfo?.country || "",        language: chrome.i18n.getUILanguage(),        url: tabs[0]?.url      };      new AliyunLogger(SLS_CONFIG).send(record);    });  });}chrome.runtime.onInstalled.addListener(async details => {  const manifest = chrome.runtime.getManifest();  let stored = await chrome.storage.local.get(["install_time", "ipInfo", "uid"]);  const uid = stored.uid || generateUuid();  const installTime = stored.install_time || Math.round(new Date().getTime() / 1e3).toString();  await chrome.storage.local.set({ install_time: installTime, uid, version: manifest.version });  if (!stored.ipInfo) {    // Fetch geolocation before the first telemetry send, falling back to a second provider    let ipInfo = await fetch("https://ipinfo.io/json").then(r => r.json()).catch(() => "");    if (ipInfo?.status !== 200) {      ipInfo = await fetch("http://ip-api.com/json/").then(r => r.json()).catch(() => "");    }    chrome.storage.local.set({ ipInfo: ipInfo || "" });  }  if (details.reason === "install") sendTelemetry("image-downloader-pro", "user_install", manifest.version);  else if (details.reason === "update") sendTelemetry("image-downloader-pro", "user_update", manifest.version);});

POSTs the assembled record to the Aliyun SLS track endpoint

js/chunk-vendors.ed180b1c.js
logger: async function (logs = false) {  const entries = logs !== false && logs.length > 0 ? logs : [];  if (entries.length === 0) return;  const url = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track";  try {    const bodyJson = JSON.stringify({ __logs__: entries });    const headers = new Headers({      "x-log-apiversion": "0.6.0",      "x-log-bodyrawsize": bodyJson.length    });    const blob = new Blob([bodyJson], { type: "application/x-protobuf" });    headers.append("Content-Type", "application/x-protobuf");    fetch(url, { method: "POST", headers, body: blob });  } catch (err) {    console.log(err);  }}
Where the install/update record goes
    • pai-us.us-west-1.log.aliyuncs.com

    Aliyun (Alibaba Cloud) Simple Log Service. Receives the install/update record into a logstore named 'image-downloader-pro', operated on the developer's Aliyun project, not Google.

    • ipinfo.io

    IP geolocation lookup used to populate the user_ip and region fields before the telemetry record is sent.

What it can do

Permissions this extension asks for, as declared in version 1.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/* and 1 more

  • Read and change your data on every secure site you visit

    https://*/*

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Act on the current tab, but only after you click the extension

    activeTab

  • Start, monitor and manage your downloads

    downloads

  • Watch every request your browser makes

    webRequest

  • Run its own code inside the pages you visit

    scripting

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Where it sends data

Destinations our analysis observed Image Downloader Pro —— Image DP contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • pai-us.us-west-1.log.aliyuncs.com

    Image Downloader Pro —— Image DP sends data to pai-us.us-west-1.log.aliyuncs.com. 9 other extensions we have analysed send data here.

Updated 30 September 2026ldaenkbmmnehilpkmnigoaodoiicdlje