Is Bulk Image downloader - Image Duke safe?
Image Duke is high risk. Image Duke fetches a ruleset from extconfig.pages.dev/config/netrule.json, applied via declarativeNetRequest. It strips Reddit's CSP, widens CORS on 26 sites, forges Referer on ~80, updatable anytime with no store update.…
Who publishes itUB - 1 other listing from the same operator, none carrying a finding
UB - 1 other listing from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 100k+ users between them, none of them carrying a finding.
Shared hosts - 3 hostnames
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote server delivers header-manipulation rules to the extension every 3 days
Image Duke fetches a ruleset from extconfig.pages.dev/config/netrule.json, applied via declarativeNetRequest.
It strips Reddit's CSP, widens CORS on 26 sites, forges Referer on ~80, updatable anytime with no store update.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
Browser starts or 3 days pass since the last rule update
te() checks chrome.storage.local config.remoteCheck. If older than 259,200,000 ms, it fetches a fresh ruleset from extconfig.pages.dev.
Extension applies the fetched header-manipulation rules to every subsequent browser request
The JSON response is loaded into chrome.declarativeNetRequest.updateSessionRules(). Active rules then intercept all matching requests and responses across all tabs.
On an interval
The extension stores config.remoteCheck in chrome.storage.local. If Date.now() minus that timestamp exceeds 3 × 24 × 60 × 60 × 1000 ms, te() triggers X(false) to pull an updated ruleset. A successful fetch updates remoteCheck via G(e).
- REDDIT_1, CSP strip
Reddit's content security policy is overwritten on every page load, removing its protection against injected scripts.
- PIXIV, Referer forge
The extension adds a forged Referer header to Pixiv CDN requests, spoofing the request origin.
- INSTA_TEST_1, CORS widen
Instagram CDN responses have their CORS policy widened to allow any origin to read the content.
- Remote update endpoint
This server can deliver new or changed header-manipulation rules to any browser running the extension.
Site-specific scripts read page data and tokens on commerce sites
On supported shopping or social sites, Bulk Image downloader - Image Duke can inject a site-specific parser script.
It reads DOM content, cookies, and storage, including auth tokens on some sites, then sends page data to the extension.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
The user activates the extension on a supported commerce or social shopping page.
The extension injects a matching parser script that can read page DOM content, cookies, and storage data.
- Page DOM contentProduct image URL and review text (illustrative)
Product details, image URLs, review comments, and other on-page values can describe what you are viewing or collecting.
- Site cookies_m_h5_tk cookie value (illustrative)
Cookies can include authentication-related values that identify your active session on the site.
- Browser storage dataSaved site state (illustrative)
Stored site values can preserve account, session, or page state beyond the currently visible document.
Observed during dynamic analysis: the automated session did not activate the downloader on a matching commerce page, so the user-action-gated injection did not run in that session. A later verification confirmed the code path that injects the site-specific parser and reads cookies or signed request values on supported sites.
What it can do
Permissions this extension asks for, as declared in version 1.2.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
http://*/*
Read and change your data on every secure site you visit
https://*/*
Start, monitor and manage your downloads
downloads
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
Show you desktop notifications
notifications