Is Nexlev YouTube Research & Analytics safe?
Nexlev is medium risk. Opening a YouTube channel page sends Nexlev a visit record with the channel ID, title, view/subscriber counts, locale, time zone, and your user ID. A captured request included title 'a-ha - Take On Me', ID UCeEi1My3KTXHT0SG1JkR9gA.
Who publishes itnexlevai - no other listings under this identity
nexlevai - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
YouTube channel visits sent to Nexlev
Opening a YouTube channel page sends Nexlev a visit record with the channel ID, title, view/subscriber counts, locale, time zone, and your user ID.
A captured request included title 'a-ha - Take On Me', ID UCeEi1My3KTXHT0SG1JkR9gA.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a YouTube channel page.
The content script subscribes to URL changes and only proceeds when the parsed page is a channel page with a channel ID.
The extension sends a channel-visit record to Nexlev's backend.
The record includes the visited channel ID, title, locale, time zone, remote host, and a Nexlev user ID when one is available.
- Visited YouTube channel IDUCeEi1My3KTXHT0SG1JkR9gA
Links the backend request to the specific YouTube channel page you opened.
- YouTube title metadataa-ha - Take On Me
Adds readable context about the YouTube content associated with the request.
- Channel popularity countstotalViewCount: 0, subscriberCount: 0
Adds channel metadata such as total views and subscriber count to the visit record.
- Locale and time zonehl: en, gl: US, timeZone: America/New_York (illustrative)
Adds regional and time-zone context to the channel visit.
- Nexlev account ID64f0c8e3f2a9b6d5c4e1a012 (illustrative)
Can associate the channel visit with the signed-in Nexlev account when one is available.
Observed during dynamic analysis: the request body included YouTube metadata/title `a-ha - Take On Me` and `ytChannelId` `UCeEi1My3KTXHT0SG1JkR9gA`.
Channel-page navigation creates a Nexlev visit record
Readable content-script updater
yt-public-features-wrapper.44023b7d.jsh = () => { let e = null, t = null, r = null, a = null, n = e => { let t = document.documentElement.getAttribute("lang"), r = { ...e, ...e.updatedAt && { updatedAt: new Date(e.updatedAt).toISOString() }, ...e.monetizationStatus?.updatedAt && { monetizationStatus: { ...e.monetizationStatus, updatedAt: new Date(e.monetizationStatus.updatedAt).toISOString() } }, hostLanguage: t }, a = (0, d.store).dispatch((0, l.channelApi).endpoints.updateChannel.initiate(r)); a.unwrap().catch(e => { f.error("Failed to persist channel to NexLev:", e) }).finally(() => { a.reset() }) }, h = async e => { let { user: t, locale: r } = await (0, s.getAuthData)(), a = { gl: r.gl, hl: r.hl, source: "channel", userId: t?._id || "", title: e.title || "", timeZone: r.timeZone, remoteHost: r.remoteHost, ytChannelId: e.ytChannelId, totalViewCount: e.totalViewCount || 0, subscriberCount: e.subscriberCount || 0 }; (0, d.store).dispatch((0, l.channelApi).endpoints.trackChannelVisit.initiate(a)).unwrap().catch(e => { f.error("Failed to track channel visit:", e) }) }, x = async t => { if (t?.page !== o.YOUTUBE_PAGE.CHANNEL) return; let i = t.channelId; if (!i || e === i) return; a?.abort(), a = new AbortController; let { signal: s } = a; e = i, r && (clearTimeout(r), r = null); try { if (s.aborted) return; let e = await (0, c.fetchChannel)(i); if (s.aborted || !e) return; let r = (0, p.youtubeStore).getState(); if (r.addChannels([e]), i !== e.ytChannelId && r.indexAlias(i, e.ytChannelId), s.aborted || t.url !== window.location.href) return; n(e), h(e) } catch (e) { if (s.aborted) return; f.error(`Failed to update channel ${i}:`, e) } finally { r = setTimeout(() => { e === i && (e = null), r = null }, 3e4) } }, m = (e, r) => { if (!(0, i.isYouTubeUrl)(e)) return; let a = (0, i.parseYouTubeUrl)(e); a && a.page === o.YOUTUBE_PAGE.CHANNEL && a.channelId && (r ? (t && clearTimeout(t), t = setTimeout(() => { x(a), t = null }, 500)) : x(a)) }, g = (0, u.UrlChangeObserver).getInstance(); g.subscribe(e => m(e, !0)), m(g.url || window.location.href, !1)}Readable background API endpoint
static/background/index.jstrackChannelVisit: e.mutation({ query: e => ({ body: e, method: "POST", url: "/visited-channel/v2" })})Observed bulk-video request is also defined in the shipped background code
Readable video API endpoint
static/background/index.jsupdateVideos: e.mutation({ query: e => ({ body: e, method: "PUT", url: "/videos/bulk" })})Readable message handler dispatch
static/background/index.jslet i = (0, n.videoApi).endpoints.updateVideos.initiate(r);try { await (0, s.store).dispatch(i).unwrap()} catch (e) { a.error("Error syncing videos:", e)} finally { t.send(void 0)}- prod.dashboard.nexlev.io
Nexlev dashboard API host. The source defines channel-visit writes under /api/visited-channel/v2, and dynamic analysis observed YouTube metadata sent to /api/videos/bulk.