Is Image Downloader Pro —— Image DP safe?
Image Downloader Pro sends install and update telemetry with the active tab URL, public IP, and a persistent UUID to Aliyun SLS.
When the extension is installed or updated, its background script queries the active tab and sends telemetry that includes the current URL, public IP address, stored UUID, OS, language, install time, and extension version. The log is posted to an Aliyun SLS endpoint for the extension's image-downloader-pro logstore.
Who publishes itzf.extension.ai.pai - 3 other listings from the same operator, none carrying a finding
zf.extension.ai.pai - 3 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
3 other listings published from this account, 16k+ users between them, none of them carrying a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Image Downloader Pro sends your tab URL, IP, and device ID on every install
On install or update, Image Downloader Pro sends the URL of your active tab, your public IP, and a persistent device ID to Aliyun's logging service, without a consent prompt.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install Image Downloader Pro, or it updates automatically.
No interaction with the extension's popup or the page is needed.
The background service worker sends the URL of your currently active tab, your public IP, and a persistent device ID to Aliyun's logging service.
The record also carries your OS, browser language, and approximate country.
- Page you were onhttps://www.example.com/checkout/cart
The full URL of your active browser tab at the moment the extension installs or updates.
- Public IP address187.40.254.11
Your IP address, fetched from a geolocation lookup right before this event is sent.
- Device ID188dad9b-23b1-4843-aec0-c969c7ef0790
A UUID created on first install and reused forever, letting Aliyun tie every future event back to this browser.
- Approximate countryBR
Your country, derived from the IP geolocation lookup.
- Browser languageen-US
Your browser's UI language setting.
200 OK. Observed during dynamic analysis immediately after the install event fired.
- Content-Type
- application/x-protobuf
- x-log-apiversion
- 0.6.0
{ "__logs__": [ { "extension_name": "image-downloader-pro", "version": "1.0.5", "user_ip": "187.40.254.11", "uuid": "188dad9b-23b1-4843-aec0-c969c7ef0790", "install_time": "1757375000", "event_time": "1757375003", "event_category": "image-downloader-pro", "event_operate": "user_install", "event_tag": "1.0.5", "browser_type": "chrome", "operate_system": "other", "region": "BR", "language": "en-US", "url": "https://www.example.com/checkout/cart" } ]}Building and sending the telemetry record in background.js
Assembles the record from the active tab and cached IP info, fires on install/update
js/background.jsfunction sendTelemetry(category, operate, tag) { chrome.tabs.query({ active: true, currentWindow: true }, tabs => { chrome.storage.local.get(["ipInfo", "install_time", "uid"], stored => { let record = { extension_name: "image-downloader-pro", version: chrome.runtime.getManifest().version, user_ip: stored.ipInfo?.ip || stored.ipInfo?.query || "", uuid: stored.uid, install_time: stored.install_time, event_time: Math.round(new Date().getTime() / 1e3).toString(), event_category: category || "", event_operate: operate || "", event_tag: tag || "", browser_type: chrome.runtime.getManifest().homepage_url.includes("chrome") ? "chrome" : "edge", operate_system: detectOS(), region: stored.ipInfo?.country || "", language: chrome.i18n.getUILanguage(), url: tabs[0]?.url }; new AliyunLogger(SLS_CONFIG).send(record); }); });}chrome.runtime.onInstalled.addListener(async details => { const manifest = chrome.runtime.getManifest(); let stored = await chrome.storage.local.get(["install_time", "ipInfo", "uid"]); const uid = stored.uid || generateUuid(); const installTime = stored.install_time || Math.round(new Date().getTime() / 1e3).toString(); await chrome.storage.local.set({ install_time: installTime, uid, version: manifest.version }); if (!stored.ipInfo) { // Fetch geolocation before the first telemetry send, falling back to a second provider let ipInfo = await fetch("https://ipinfo.io/json").then(r => r.json()).catch(() => ""); if (ipInfo?.status !== 200) { ipInfo = await fetch("http://ip-api.com/json/").then(r => r.json()).catch(() => ""); } chrome.storage.local.set({ ipInfo: ipInfo || "" }); } if (details.reason === "install") sendTelemetry("image-downloader-pro", "user_install", manifest.version); else if (details.reason === "update") sendTelemetry("image-downloader-pro", "user_update", manifest.version);});POSTs the assembled record to the Aliyun SLS track endpoint
js/chunk-vendors.ed180b1c.jslogger: async function (logs = false) { const entries = logs !== false && logs.length > 0 ? logs : []; if (entries.length === 0) return; const url = "https://" + this.project + "." + this.host + "/logstores/" + this.logstore + "/track"; try { const bodyJson = JSON.stringify({ __logs__: entries }); const headers = new Headers({ "x-log-apiversion": "0.6.0", "x-log-bodyrawsize": bodyJson.length }); const blob = new Blob([bodyJson], { type: "application/x-protobuf" }); headers.append("Content-Type", "application/x-protobuf"); fetch(url, { method: "POST", headers, body: blob }); } catch (err) { console.log(err); }}- pai-us.us-west-1.log.aliyuncs.com
Aliyun (Alibaba Cloud) Simple Log Service. Receives the install/update record into a logstore named 'image-downloader-pro', operated on the developer's Aliyun project, not Google.
- ipinfo.io
IP geolocation lookup used to populate the user_ip and region fields before the telemetry record is sent.
What it can do
Permissions this extension asks for, as declared in version 1.0.5. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/* and 1 more
Read and change your data on every secure site you visit
https://*/*
See the address and title of every tab you have open
tabs
Store data in your browser
storage
Act on the current tab, but only after you click the extension
activeTab
Start, monitor and manage your downloads
downloads
Watch every request your browser makes
webRequest
Run its own code inside the pages you visit
scripting
Block and redirect the requests your browser makes
declarativeNetRequest
Where it sends data
Destinations our analysis observed Image Downloader Pro —— Image DP contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- pai-us.us-west-1.log.aliyuncs.com
Image Downloader Pro —— Image DP sends data to pai-us.us-west-1.log.aliyuncs.com. 9 other extensions we have analysed send data here.