Who makes Pixiv Toolkit?

Pixiv Toolkit is published by Leo Ding.

Is Pixiv Toolkit safe?

Q: Is Pixiv Toolkit safe?

Pixiv Toolkit is low risk. The rating reflects signals from our analysis that have not yet been published as detailed findings.

Low risk

Pixiv Toolkit overrides CORS headers on Pixiv and pximg domains, allowing any webpage to read image resources cross-origin.

The extension registers webRequest listeners on Pixiv-related domains and injects a forged Referer header to bypass hotlink protection on pximg.net. It also rewrites Access-Control-Allow-Origin response headers to '*', removing the original value. This means any webpage — not only pixiv.net or fanbox.cc — can issue cross-origin requests to i.pximg.net and read the response content in JavaScript.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Leo Dingv4.9.0Firefox Add-ons

17Risk

Who publishes it

Leo Ding - no other listings under this identity, 5 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher

Leo Ding

Website

github.com/leoding86/webextension-pixiv-toolkit

Shared hosts - 5 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

downloads.fanbox.cc

Also called by 3 other listings, including Pixiv Fanbox Downloader

fanbox.cc

Also called by 3 other listings, including PTK, Pixiv Fanbox Downloader

s.pximg.net

Also called by 3 other listings, including PTK

api.fanbox.cc

Also called by 4 other listings, including PTK, Pixiv Fanbox Downloader

kazupon.github.io

Also called by 5 other listings, including PTK, start.me, Bookmarker by start.me

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 4.9.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

Read and change your data on pixiv.net
*://*.pixiv.net/*
Read and change your data on pximg.net
*://*.pximg.net/*
Read and change your data on techorus-cdn.com
*://*.techorus-cdn.com/*
Read and change your data on fanbox.cc
*://*.fanbox.cc/*
Watch every request your browser makes
webRequest
Watch, block and rewrite every request your browser makes
webRequestBlocking
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage