Is Music Identifier - Find any song from browser safe?
Music Identifier is medium risk. On install, Music Identifier's service worker fetches JSON settings from song-identify.com, an operator domain, and saves it locally. The automatic, unprompted fetch lets the operator change behavior remotely without a code update.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote configuration fetched from operator domain on install
On install, Music Identifier's service worker fetches JSON settings from song-identify.com, an operator domain, and saves it locally.
The automatic, unprompted fetch lets the operator change behavior remotely without a code update.
You install the Music Identifier extension.
The service worker fetches a JSON configuration file from song-identify.com and stores it in your browser without a consent prompt.
Any errors during the fetch are discarded without logging. The stored settings object can contain arbitrary keys that affect extension behavior.
The operator's server delivered this config on install. Fields like `isInstall`, `isOpen`, `count` can gate prompts or feature flags.
chrome.storage.local key 'settings'{
"count": 10,
"isOpen": true,
"status": "ok",
"message": "",
"isInstall": true,
"request_id": 0
}Remote config fetch on install (bg.js:1-13)
chrome.runtime.onInstalled.addListener(async (event) => {
if (event.reason === chrome.runtime.OnInstalledReason.INSTALL) {
await (async function fetchRemoteConfig() {
try {
const response = await fetch('https://song-identify.com/settings.json');
if (!response.ok) throw new Error('Network response was not ok');
const config = await response.json();
if (config.error) throw new Error(config.error);
chrome.storage.local.set({ settings: config }); // store operator config
} catch (e) { /* errors discarded, no logging */ }
})();
}
});- song-identify.com
Extension operator's domain. Serves the settings.json configuration fetched on every fresh install. Distinct from shazam.com, which handles song recognition.
Persistent install ID sent with every song-recognition request and beacon
Music Identifier assigns each install a unique ID (`inid`) on first popup open, stores it a year, and sends it with every Shazam request and analytics beacon, linking your activity to one profile.
Undisclosed in the listing.
You open the Music Identifier popup for the first time.
The extension generates a random UUID and saves it in your browser under `inidDetails` with a one-year expiry.
Every subsequent song lookup and UI interaction sends this same UUID to Shazam, letting them correlate your activity over the lifetime of the ID.
| Content-Type | application/json |
{
"data": "<base64-audio-fingerprint>",
"sessionId": "f3a1b2c4-9e7d-4f6a-8b0c-1d2e3f4a5b6c",
"inid": "bd7b31a6-220a-4695-95d4-1c07534df9ac",
"lang": "en",
"country": "US"
}Stored in local extension storage with an expiry timestamp. Persists across restarts and is reused a full year before a new ID is generated.
chrome.storage.local key 'inidDetails'{
"inid": "bd7b31a6-220a-4695-95d4-1c07534df9ac",
"inidExpiry": 1780000000
}UUID generation and storage (popup.js:16478-16495)
const stored = e.inidDetails;
const expiry = stored && stored.inidExpiry;
const nowSec = Math.round(Date.now() / 1000);
if (!stored || nowSec > expiry) {
const uuid = `${randomHex(8)}-${randomHex(4)}-${randomHex(4)}-${randomHex(4)}-${randomHex(12)}`;
const lifetimeSec = 31536000; // 1 year
const newExpiry = Math.round(Date.now() / 1000) + lifetimeSec;
chrome.storage.local.set({ inidDetails: { inid: uuid, inidExpiry: newExpiry } });
}- www.shazam.com
Song recognition API. Every POST to /services/webrec/match_extensionv2 includes the inid field in the JSON body.
- beacon.shazam.com
Analytics and event tracking. The inid appears as a path segment in every beacon URL, covering popup pageviews and tagging lifecycle events.